CVE-2023-30861: Session Cookie Disclosure in Flask

CVSS 7.5 HIGH - Session cookie disclosure in Flask via missing Vary: Cookie header. Specific conditions apply.

CVE-2023-30861 is a session cookie disclosure vulnerability in Flask. The flaw occurs when Flask is hosted behind a caching proxy that does not strip cookies. Vulnerable Flask versions set the Vary: Cookie header only when the session is accessed or modified, not during session refresh. This allows caching proxies to serve one client's session cookie to other clients.

The vulnerability has CVSS 7.5 (HIGH). It requires specific concurrent conditions: session.permanent = True, no session access/modification during the request, SESSION_REFRESH_EACH_REQUEST enabled (default), no Cache-Control private header. Identified May 2023, fixed with Flask 2.3.2 and 2.2.5. Educational GitHub lab reported November 2026 shows ongoing interest.

Upgrade Flask to 2.3.2 or 2.2.5 to eliminate the vulnerability. Verify your caching proxy: it must not cache responses with Set-Cookie headers. Administrators should audit Flask applications in production for current versions and proxy presence. If upgrading is blocked, implement Cache-Control: private header for pages using sessions. Monitor sessions for anomalous activity.

At a glance

What: Session cookie disclosure in Flask when caching proxy does not prevent caching responses with cookies and Vary: Cookie header is not set during session refresh (only on access/modification)
Severity: CVSS 7.5 (HIGH) - Severity depends on the application's use of the session and the proxy's behavior regarding cookies
Affected versions: Flask < 2.3.2 and Flask < 2.2.5
Fix: Update to Flask 2.3.2 or 2.2.5. Verify that the proxy does not cache responses with Set-Cookie
Status: Resolved May 2023. Fix available
Action: Update Flask to latest patches, verify caching proxy configuration, check session.permanent and SESSION_REFRESH_EACH_REQUEST settings

Sources: NVD, CVE-2023-30861

← All articles