Cyber Resilience

CVE-2026-35192

Djangoproject Django 5.2 – 5.2.14

Published
05 May 2026
Modified
17 June 2026
Patch / advisory
View advisory
CVSS Score v4 2.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0054 43th percentile
Risk Priority 15 floored blend · peak EPSS

Summary

CVE-2026-35192 is a low-severity Use of Persistent Cookies Containing Sensitive Information (CWE-539) vulnerability in Djangoproject Django. Its CVSS base score is 2.3 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Steal Web Session Cookie (T1539); ranked at the 43th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability Data

An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. Response headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a user's session after that user…

more

visits a cached public page. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.

CWE(s)
CWE-539

Related Threats

MITRE ATT&CK Enterprise Techniques

T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
attack.mitre.org →
T1550.004 Web Session Cookie Lateral Movement
Adversaries can use stolen session cookies to authenticate to web applications and services.
attack.mitre.org →
T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
attack.mitre.org →
T1528 Steal Application Access Token Credential Access
Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-6907Same product: Djangoproject Django
CVE-2026-48588Same product: Djangoproject Django
CVE-2026-35193Same product: Djangoproject Django
CVE-2026-3902Same product: Djangoproject Django
CVE-2022-34265Same product: Djangoproject Django
CVE-2024-39330Same product: Djangoproject Django
CVE-2026-1207Same product: Djangoproject Django
CVE-2026-1287Same product: Djangoproject Django
CVE-2024-24680Same product: Djangoproject Django
CVE-2024-41989Same product: Djangoproject Django

Affected Assets

djangoproject
django
5.2 — 5.2.14 · 6.0 — 6.0.5

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 full match
prevents

Secure SDLC practices and coding standards directly prohibit storing sensitive data in persistent cookies.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect and prevent use of persistent cookies with sensitive data.

A.5.34 Privacy and protection of PII partial match
mitigates

Privacy and PII protection policies require safeguards against exposing sensitive data via cookies.

A.8.1 User end point devices partial match
degrades

Endpoint device configuration can enforce cookie lifetime and encryption policies.

A.8.10 Information deletion partial match
mitigates

Information deletion policies can mandate removal or encryption of sensitive cookie data.

A.8.12 Data leakage prevention partial match
mitigates

Data leakage prevention controls can block or encrypt sensitive information in cookies.

A.8.24 Use of cryptography partial match
degrades

Cryptographic controls can mandate encryption of sensitive data stored in cookies.

References