Is CVE-2026-6907 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6907 being exploited in the wild.

How severe is CVE-2026-6907?

Medium severity, with a CVSS score of 4.3, published 5 May 2026.

Which products and versions are affected?

Django (PyPI) ECOSYSTEM:introduced=5.2,fixed=5.2.14,introduced=6.0,fixed=6.0.5, ECOSYSTEM:introduced=6.0,fixed=6.0.5.

Is there a fix for CVE-2026-6907?

Yes. Django (PyPI): upgrade to 6.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-6907 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6907?

Check whether you run Djangoproject Django or Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6907: Django incorrect caching of sensitive information in UpdateCacheMiddleware

CVE-2026-6907 · Severity: medium · CVSS 4.3 · Published 2026-05-05

Django is a popular web framework used to build and power websites. A vulnerability in its caching system could cause the server to accidentally store and serve private, user-specific data to other visitors. This could lead to the exposure of sensitive information to unauthorized individuals.

Technologies: Djangoproject Django, Django (PyPI). Vendors: Djangoproject, PyPI.

Quick answers

Is CVE-2026-6907 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6907 being exploited in the wild.
How severe is CVE-2026-6907?: Medium severity, with a CVSS score of 4.3, published 5 May 2026.
Which products and versions are affected?: Django (PyPI) ECOSYSTEM:introduced=5.2,fixed=5.2.14,introduced=6.0,fixed=6.0.5, ECOSYSTEM:introduced=6.0,fixed=6.0.5.
Is there a fix for CVE-2026-6907?: Yes. Django (PyPI): upgrade to 6.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6907 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6907?: Check whether you run Djangoproject Django or Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Django (PyPI): upgrade to 6.0.5 or later
```
pip install "Django>=6.0.5"
```

Technical details

A vulnerability exists in Django's UpdateCacheMiddleware (CWE-524) where the middleware incorrectly caches responses even when the 'Vary' HTTP header contains an asterisk ('*'). According to HTTP standards, a 'Vary: *' header indicates that the response is uncacheable because it depends on information not present in the request headers. By caching these responses, Django may serve one user's private data to subsequent requesters. The issue affects Django versions 6.0.x before 6.0.5 and 5.2.x before 5.2.14; older unsupported versions may also be vulnerable. Patches are available in versions 6.0.5 and 5.2.14.

Affected products

Django Software Foundation Django >= 6.0, < 6.0.5; >= 5.2, < 5.2.14

Identifiers

CVE-2026-6907
GHSA-5hrc-gvxj-w55p
PYSEC-2026-55

Timeline

2026-05-05: disclosed
2026-05-05: advisory
2026-05-05: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.