CVE-2026-48588: Django Cache Middleware Data Leakage Vulnerability

Technical summary

CVE-2026-48588 affects Django's `UpdateCacheMiddleware` and `cache_page()` decorator in versions 6.0 before 6.0.7 and 5.2 before 5.2.16. The vulnerability stems from improper cache key generation when requests carry cookies. The middleware caches HTTP responses that should vary based on cookie values, but fails to account for the presence of unrelated cookies in the request. This violates cache coherency assumptions and allows an attacker to retrieve cached responses intended for other users. The issue is classified under CWE-524 (Unprotected Transport of Credentials), reflecting the potential leakage of session-bound or user-specific data through the shared cache. Earlier unsupported Django versions (5.0.x, 4.1.x, 3.2.x) may also be vulnerable but have not been formally evaluated by the Django project.

Business impact

Organizations running Django applications that rely on caching for performance may inadvertently expose user-specific data such as personalized content, session information, or other sensitive details. The impact varies by application design: a site that caches user dashboards, shopping carts, or private communications faces higher risk. Since the vulnerability requires specific request conditions and user interaction, the real-world attack surface is limited, but the consequences of exploitation—unauthorized access to private user data—carry reputational and compliance implications. Applications with strict data segregation requirements or handling regulated data should prioritize assessment.

Affected systems

Django 6.0.0 through 6.0.6 and Django 5.2.0 through 5.2.15 are confirmed affected. Django maintainers have not officially evaluated unsupported series 5.0.x, 4.1.x, and 3.2.x, though they may be vulnerable due to shared caching logic. Organizations using the `cache_page()` decorator or `UpdateCacheMiddleware` are directly exposed. Applications that do not use Django's built-in caching mechanisms are not affected.

Exploitability

This vulnerability requires network access and user interaction (CVSS vector: AV:N/AC:H/PR:N/UI:R). The attacker cannot exploit it passively; they must craft specific requests that trigger cache hits and must have some ability to influence the caching behavior or request patterns. The moderate complexity (AC:H) stems from the need to align request timing and cookie conditions. This is not a trivial exploit but remains achievable in multi-user environments where cache behavior is predictable. No public exploit code or proof-of-concept is currently known, and the vulnerability is not tracked on the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Upgrade Django to version 6.0.7 or later for the 6.0 series, or to version 5.2.16 or later for the 5.2 series. These patches correct the cache key generation logic to properly account for cookie variations. After patching, verify cache behavior in test environments, especially for applications that depend on session-based or personalized caching. Organizations running unsupported Django versions should migrate to a supported release as soon as feasible; if immediate migration is not possible, implement cache invalidation strategies or disable middleware-level caching pending remediation.

Patch guidance

Apply Django security updates as follows: For Django 6.0, upgrade to 6.0.7 or any subsequent release. For Django 5.2, upgrade to 5.2.16 or any subsequent release. For unsupported series, review the vendor advisory and security announcements to determine if patches are available. Test patches in a staging environment to confirm cache behavior and application functionality remain intact. Because this vulnerability affects caching behavior, monitor application logs and cache hit/miss ratios after patching to ensure proper operation. Consider scheduling patching during low-traffic windows to minimize performance impact during the transition.

Detection guidance

Monitor web server and application logs for unusual cache-related behavior, such as unexpected cache hits or requests from different IP addresses returning identical cached content. If your Django application logs cache operations, look for patterns where unrelated cookie values correlate with identical cached responses. Network-based detection is difficult because the vulnerability manifests as legitimate cache behavior; focus on application-level inspection. Check Django application settings to identify use of `cache_page()` or `UpdateCacheMiddleware`, as these are the attack surface. If caching is not critical to your deployment, temporarily disabling it can serve as a temporary mitigation while patches are tested.

Why prioritize this

Although rated CVSS 3.1 (LOW) due to high attack complexity and user interaction requirements, this vulnerability warrants prompt attention for organizations handling sensitive user data. The core issue—unintended data leakage via shared caches—has compliance implications for regulated industries. Prioritization should reflect your application's use of Django caching and the sensitivity of cached data. Applications serving multiple distinct user communities or handling PII should treat this as medium-priority; those using simple static caching may defer until regular patch cycles.

Risk score, explained

The CVSS 3.1 score of 3.1 reflects: Network accessibility (AV:N), high attack complexity due to the specific conditions required to trigger cache misalignment (AC:H), no privilege requirement (PR:N), requirement for user interaction to trigger the vulnerable code path (UI:R), unchanged scope (S:U), and limited confidentiality impact (C:L) with no integrity or availability impact (I:N/A:N). The score appropriately discounts the severity because exploitation is not straightforward and does not grant system-level access. However, the actual risk to an organization depends on data sensitivity and cache usage patterns.

Frequently asked questions