Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware
Published May 5, 2026
2.3
LOWCVSS 4.0
EPSS 0.44%
Description
An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`'*'`). This can lead to private data being stored and served. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Ahmad Sadeddin for reporting this issue.
Affected products
-
- Version 5.2StatusaffectedConstraints<5.2.14
- Version 6.0StatusaffectedConstraints<6.0.5
- Version 5.2.14StatusunaffectedConstraints-
- Version 6.0.5StatusunaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Djangoproject | Django | unaffected |
|
- ≥ 5.2 · < 5.2.14
- ≥ 6.0 · < 6.0.5
No data.
Red Hat Ansible Automation Platform 2
ansible-automation-platform-24/lightspeed-rhel8
Fix deferred
Red Hat Ansible Automation Platform 2
ansible-automation-platform-25/lightspeed-rhel8
Fix deferred
Red Hat Ansible Automation Platform 2
ansible-automation-platform-26/controller-rhel9
Fix deferred
Red Hat Ansible Automation Platform 2
ansible-automation-platform-26/eda-controller-rhel9
Fix deferred
Red Hat Ansible Automation Platform 2
ansible-automation-platform-26/gateway-rhel9
Fix deferred
Red Hat Ansible Automation Platform 2
ansible-automation-platform-26/hub-rhel9
Fix deferred
Red Hat Ansible Automation Platform 2
ansible-automation-platform-26/lightspeed-rhel9
Fix deferred
Red Hat Ansible Automation Platform 2
ansible-automation-platform-27/aap-cloud-billing-rhel9
Under investigation
Red Hat Ansible Automation Platform 2
ansible-automation-platform-27/controller-rhel9
Under investigation
Red Hat Ansible Automation Platform 2
ansible-automation-platform-27/eda-controller-rhel9
Under investigation
Red Hat Ansible Automation Platform 2
ansible-automation-platform-27/gateway-rhel9
Under investigation
Red Hat Ansible Automation Platform 2
ansible-automation-platform-27/hub-rhel9
Under investigation
Red Hat Ansible Automation Platform 2
ansible-automation-platform-27/lightspeed-rhel9
Under investigation
Red Hat Ansible Automation Platform 2
ansible-automation-platform-27/metrics-service-rhel9
Under investigation
Red Hat Ansible Automation Platform 2
ansible-automation-platform-tech-preview/metrics-service-rhel9
Fix deferred
Red Hat Ansible Automation Platform 2
ansible-automation-platform/automation-dashboard-rhel9
Fix deferred
Red Hat Ansible Automation Platform 2
automation-controller
Fix deferred
Red Hat Ansible Automation Platform 2
python-django
Fix deferred
Red Hat Discovery 2
discovery/discovery-server-rhel9
Fix deferred
Red Hat OpenStack Platform 16.2
python-django20
Fix deferred
Red Hat OpenStack Platform 17.1
python-django
Fix deferred
Red Hat OpenStack Platform 18.0
python-django
Fix deferred
Red Hat Satellite 6
python-django
Fix deferred
Red Hat Satellite 6
satellite/iop-advisor-backend-rhel9
Under investigation
Red Hat Satellite 6
satellite:el8/python-django
Fix deferred
Red Hat Update Infrastructure 4 for Cloud Providers
python-django
Fix deferred
Self-service automation portal 2
ansible-automation-platform/bootc-automation-portal-rhel9
Under investigation
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/lightspeed-rhel8 | Fix deferred | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/lightspeed-rhel8 | Fix deferred | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/controller-rhel9 | Fix deferred | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/eda-controller-rhel9 | Fix deferred | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/gateway-rhel9 | Fix deferred | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/hub-rhel9 | Fix deferred | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/lightspeed-rhel9 | Fix deferred | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-27/aap-cloud-billing-rhel9 | Under investigation | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-27/controller-rhel9 | Under investigation | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-27/eda-controller-rhel9 | Under investigation | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-27/gateway-rhel9 | Under investigation | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-27/hub-rhel9 | Under investigation | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-27/lightspeed-rhel9 | Under investigation | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-27/metrics-service-rhel9 | Under investigation | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-tech-preview/metrics-service-rhel9 | Fix deferred | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform/automation-dashboard-rhel9 | Fix deferred | n/a |
| Red Hat Ansible Automation Platform 2 | automation-controller | Fix deferred | n/a |
| Red Hat Ansible Automation Platform 2 | python-django | Fix deferred | n/a |
| Red Hat Discovery 2 | discovery/discovery-server-rhel9 | Fix deferred | n/a |
| Red Hat OpenStack Platform 16.2 | python-django20 | Fix deferred | n/a |
| Red Hat OpenStack Platform 17.1 | python-django | Fix deferred | n/a |
| Red Hat OpenStack Platform 18.0 | python-django | Fix deferred | n/a |
| Red Hat Satellite 6 | python-django | Fix deferred | n/a |
| Red Hat Satellite 6 | satellite/iop-advisor-backend-rhel9 | Under investigation | n/a |
| Red Hat Satellite 6 | satellite:el8/python-django | Fix deferred | n/a |
| Red Hat Update Infrastructure 4 for Cloud Providers | python-django | Fix deferred | n/a |
| Self-service automation portal 2 | ansible-automation-platform/bootc-automation-portal-rhel9 | Under investigation | n/a |
No package ranges for this CVE.
Remediation
Red Hat mitigation
To mitigate this issue, disable the `django.middleware.cache.UpdateCacheMiddleware` in your Django application's `settings.py` file by removing it from the `MIDDLEWARE` list. This action prevents the erroneous caching of requests with an asterisk in the `Vary` header, thereby eliminating the information disclosure vulnerability. Be aware that disabling this middleware will also deactivate Django's built-in caching functionality, which may affect application performance and behavior. A restart of the Django application server is required for this change to take effect.
References (9)
- https://access.redhat.com/security/cve/CVE-2026-6907 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2466771 Issue Tracking
- https://docs.djangoproject.com/en/dev/releases/security vendor-advisoryVendor Advisory
- https://github.com/advisories/GHSA-5hrc-gvxj-w55p Advisory
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-55.yaml
- https://groups.google.com/g/django-announce mailing-listThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-6907
- https://www.cve.org/CVERecord?id=CVE-2026-6907
- https://www.djangoproject.com/weblog/2026/may/05/security-releases vendor-advisoryVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-6907 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2466771 | Issue Tracking | |
| https://docs.djangoproject.com/en/dev/releases/security | vendor-advisoryVendor Advisory | |
| https://github.com/advisories/GHSA-5hrc-gvxj-w55p | Advisory | |
| https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-55.yaml | ||
| https://groups.google.com/g/django-announce | mailing-listThird Party Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2026-6907 | ||
| https://www.cve.org/CVERecord?id=CVE-2026-6907 | ||
| https://www.djangoproject.com/weblog/2026/may/05/security-releases | vendor-advisoryVendor Advisory |
Change history (0)
No recorded changes yet.