CVE-2026-48588: Potential exposure of private data via cached Set-Cookie response
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. UpdateCacheMiddleware and the cachepage() decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Chris Whyland for reporting this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 6.0.7 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 5.2.16 - Compensating control
Mitigate CVE-2026-48588/CVE-2026-53877/CVE-2026-53878 by preventing shared caching of responses that vary on cookies when unrelated cookies are present (i.e., address how UpdateCacheMiddleware/cache_page() cache cookie-varying responses to avoid remote attackers reading private data from the shared cache) until the fixed Django versions are applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48588?
CVE-2026-48588 has a medium severity rating of 4.2.
How do I fix CVE-2026-48588?
To fix CVE-2026-48588, you should upgrade Django to version 6.0.7 or 5.2.16 or later.
What type of vulnerability is CVE-2026-48588?
CVE-2026-48588 is a vulnerability that allows potential exposure of private data due to caching mechanisms in Django.
Which versions of Django are affected by CVE-2026-48588?
CVE-2026-48588 affects Django versions 6.0 prior to 6.0.7 and 5.2 prior to 5.2.16.
What are the implications of CVE-2026-48588?
The implications of CVE-2026-48588 include the risk of remote attackers accessing private data from a shared cache.