Is CVE-2026-35193 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35193 being exploited in the wild.

How severe is CVE-2026-35193?

Medium severity, with a CVSS score of 4, published 3 June 2026.

Which products and versions are affected?

Django (PyPI) ECOSYSTEM:introduced=5.2,fixed=5.2.15,introduced=6.0,fixed=6.0.6, ECOSYSTEM:introduced=5.2.0,fixed=5.2.15.

Is there a fix for CVE-2026-35193?

Yes. Django (PyPI): upgrade to 5.2.15, 6.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35193 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-35193?

Check whether you run Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35193: Django UpdateCacheMiddleware information disclosure via missing Vary header

CVE-2026-35193 · Severity: medium · CVSS 4 · Published 2026-06-03

A vulnerability in the Django web framework's caching system could allow unauthorized users to view private data. When a website uses certain caching settings, the system may fail to distinguish between public content and content intended only for specific logged-in users. This could result in sensitive information being served to the wrong person if they visit the same web address.

Technologies: Django (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-35193 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35193 being exploited in the wild.
How severe is CVE-2026-35193?: Medium severity, with a CVSS score of 4, published 3 June 2026.
Which products and versions are affected?: Django (PyPI) ECOSYSTEM:introduced=5.2,fixed=5.2.15,introduced=6.0,fixed=6.0.6, ECOSYSTEM:introduced=5.2.0,fixed=5.2.15.
Is there a fix for CVE-2026-35193?: Yes. Django (PyPI): upgrade to 5.2.15, 6.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35193 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-35193?: Check whether you run Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Django (PyPI): upgrade to 5.2.15, 6.0.6 or later
```
pip install "Django>=6.0.6"
```

Technical details

A vulnerability exists in django.middleware.cache.UpdateCacheMiddleware where the 'Authorization' header is not automatically added to the 'Vary' response header. This occurs when a request includes an Authorization header but the response does not specify 'Cache-Control: public'. Consequently, a downstream cache or the Django internal cache might serve a response intended for an authenticated user to an unauthenticated attacker requesting the same URL. This is classified as a 'Use of Cache Containing Sensitive Information' (CWE-524). The issue is resolved in Django versions 5.2.15 and 6.0.6.

Affected products

Django Software Foundation Django >= 5.2.0, < 5.2.15
Django Software Foundation Django >= 6.0.0, < 6.0.6

Identifiers

CVE-2026-35193
GHSA-qpc8-7fxc-cm4p
PYSEC-2026-197

Timeline

2026-06-03: disclosed
2026-06-03: patched
2026-06-03: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.