Django security archiveVendor advisory
https://docs.djangoproject.com/en/dev/releases/security CVE-2026-35193
LOW
Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware
Record summary
CVE-2026-35193 has a selected CVSS score of 2.3 (low).
Description
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not add `Authorization` to the `Vary` response header for requests bearing that header without `Cache-Control: public`, which allows remote attackers to read private cached responses via unauthenticated requests to the same URL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Shai Berger for reporting this issue.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 3, 2026 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
Default status: unaffected | CVE List | 6.0 to < 6.0.6 | affected |
| 6.0.6 | unaffected | ||
| 5.2 to < 5.2.15 | affected | ||
| 5.2.15 | unaffected | ||
djangoBrowse PyPI / django | GitHub Advisory | 5.2.0 to < 5.2.15 · Fixed in 5.2.15 | affected |
| 6.0.0 to < 6.0.6 · Fixed in 6.0.6 | affected |
References
8github.com
https://github.com/django/django/commit/050a3dc276f9142067260e990e4d8d42d5e32863 github.com
https://github.com/django/django/commit/664652f1a2dd80d8a4cd491b4313cad915ae6669 github.com
https://github.com/django/django/commit/a2faa8e895926ac5d63f72879b5ccf671b5b4ba9 github.com
https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-197.yaml Django releases announcementsmailing list
https://groups.google.com/g/django-announce nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-35193 Django security releases issued: 6.0.6 and 5.2.15Vendor advisory
https://www.djangoproject.com/weblog/2026/jun/03/security-releases