CVE-2026-8404: 
Django vulnerability analysis and mitigation

CVE-2026-8404 is an information disclosure vulnerability in Django's UpdateCacheMiddleware caused by improper case-insensitive handling of Cache-Control response directives. It affects Django 5.2 before 5.2.15 and 6.0 before 6.0.6; earlier unsupported series (5.0.x, 4.1.x, 3.2.x) were not formally evaluated but may also be affected. The vulnerability was discovered by Ahmed Badawe and publicly disclosed on June 3, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 2.3 (Low) (GitHub Advisory, Django Security Releases).

The root cause is classified under CWE-178 (Improper Handling of Case Sensitivity) and CWE-1289 (Improper Validation of Unsafe Equivalence in Input). Django's django.middleware.cache.UpdateCacheMiddleware performs case-sensitive string matching when evaluating Cache-Control response directives (e.g., no-store, private). When an application or upstream component sends these directives in uppercase or mixed-case (e.g., No-Store, PRIVATE), the middleware fails to recognize them and incorrectly caches the response. An unauthenticated remote attacker can then retrieve these cached responses, which were intended to be non-cacheable or private. Exploitation requires some form of passive user interaction (e.g., a legitimate user triggering the cacheable response) (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in unauthorized disclosure of responses that should not have been cached — potentially exposing sensitive user data, session information, or private content to unauthenticated attackers. The impact is limited to confidentiality (low), with no integrity or availability consequences. Lateral movement is not a direct risk, but exposure of cached authenticated responses could facilitate further attacks such as session hijacking or credential harvesting (GitHub Advisory, Django Security Releases).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.038–0.041%, placing it in the 13th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify a vulnerable Django deployment: Locate a web application running Django 5.2 < 5.2.15 or 6.0 < 6.0.6 with UpdateCacheMiddleware enabled and a shared cache (e.g., Memcached, Redis) configured.
2. Trigger a response with mixed-case Cache-Control directives: Identify or craft a request that causes the Django application to emit a response with uppercase or mixed-case Cache-Control directives (e.g., Cache-Control: No-Store or Cache-Control: PRIVATE). This may occur naturally in applications that set headers programmatically or via upstream proxies.
3. Observe incorrect caching: Because UpdateCacheMiddleware performs case-sensitive matching, it fails to recognize the non-cacheable directive and stores the response in the cache.
4. Retrieve the cached response: Send a subsequent unauthenticated HTTP request for the same resource. The cache serves the previously stored response, exposing content that was intended to be private or non-cacheable to the attacker (GitHub Advisory, Django Security Releases).

• Network: Repeated unauthenticated HTTP GET requests to endpoints that normally require authentication or return Cache-Control: no-store/private headers; cache HIT responses (e.g., X-Cache: HIT) on resources that should never be cached.
• Logs: Web server or cache proxy logs showing cache HITs on URLs associated with authenticated or sensitive content; responses with mixed-case Cache-Control headers (e.g., No-Store, PRIVATE) being served from cache.
• Application: Django application logs showing UpdateCacheMiddleware caching responses for URLs that include session-specific or user-specific data.

Upgrade Django to version 5.2.15 or later (for the 5.2 series) or 6.0.6 or later (for the 6.0 series), which fix the case-insensitive matching of Cache-Control directives in UpdateCacheMiddleware (Django Security Releases, Django 5.2.15 Release Notes). As a workaround, ensure that all Cache-Control directives in application responses are consistently lowercase, or disable UpdateCacheMiddleware if caching of sensitive responses is a concern. Operators running unsupported Django series (5.0.x, 4.1.x, 3.2.x) should evaluate their exposure and migrate to a supported, patched version. SUSE and openSUSE have also issued security updates for their packaged versions of python-django (SUSE Advisory).

The Django project publicly acknowledged the vulnerability in its June 3, 2026 security release blog post and credited Ahmed Badawe for responsible disclosure (Django Security Releases). Red Hat tracked the issue via Bugzilla and assessed it as low severity (Red Hat Bugzilla). The vulnerability was also discussed on the oss-security mailing list (oss-sec). Downstream Linux distributions including SUSE, openSUSE, and Fedora issued security advisories and updated packages shortly after disclosure.