CVE-2026-6907

medium Red Hat
CVSS v3 Base Score
4.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
EPSS Score
0.0%
Exploitation probability in 30 days
Top 91% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Published: May 5, 2026 (65 days ago)
Last Modified: May 5, 2026
Vendor: Red Hat
Source: REDHAT

Description

A flaw was found in Django. The `django.middleware.cache.UpdateCacheMiddleware` component incorrectly caches web requests when the `Vary` header contains an asterisk ('*'). This error can lead to sensitive private data being stored in the cache and subsequently served to unauthorized users, resulting in information disclosure.

CWE

CWE-524

Affected Products

Red Hat Ansible Automation Platform 2Red Hat Discovery 2Red Hat OpenStack Platform 16.2Red Hat OpenStack Platform 17.1Red Hat OpenStack Platform 18.0Red Hat Satellite 6Red Hat Update Infrastructure 4 for Cloud Providers

References

🔗 bugzilla.redhat.com 🔗 www.cve.org 🔗 nvd.nist.gov 🔗 docs.djangoproject.com 🔗 groups.google.com