Quick answers
- Is CVE-2024-34069 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-34069 being exploited in the wild.
- How severe is CVE-2024-34069?
- Low severity, with a CVSS score of 3.1, published 7 July 2026.
- Which products and versions are affected?
- werkzeug (PyPI) ECOSYSTEM:introduced=0,fixed=3.0.3.
- Is there a fix for CVE-2024-34069?
- Yes. werkzeug (PyPI): upgrade to 3.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2024-34069 attacked?
- It is attacked over the network.
- Am I affected by CVE-2024-34069?
- Check whether you run werkzeug (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- werkzeug (PyPI): upgrade to 3.0.3 or later
pip install "werkzeug>=3.0.3"
Technical details
The vulnerability is a cross-site request forgery (CWE-352) flaw in the Werkzeug debugger that allows an attacker to gain unauthorized access to the debugger interface. An attacker can craft a malicious domain and subdomain under their control, and if they trick a developer into visiting it, they can bypass the PIN protection and access the debugger even when it is running only on localhost. This requires the attacker to guess a URL that triggers the debugger in the target application, but if successful, provides unrestricted code execution. The vulnerability was patched in version 3.0.3; all earlier versions (0.x through 3.0.2) are affected.
Affected products
- Pallets Werkzeug <3.0.3
Identifiers
- CVE-2024-34069
- GHSA-2g68-c3qc-8985
- PYSEC-2026-2043
Timeline
- 2024-05-06: disclosed
- 2024-05-06: patched: Version 3.0.3 released with fix