Flask 3.1.2 and earlier miss the Vary: Cookie header when the session object is accessed, which can lead to the response being cached by intermediate proxies when the request includes a cookie. This allows a caching system to store a page that may contain user‑specific data and later serve it to other users, thus exposing sensitive information.

All installations of Flask 3.1.2 or earlier, including standard deployments of the pallets:flask framework.

The CVSS score of 2.3 indicates low severity, and the EPSS score of less than 1% reflects a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the application to sit behind a caching proxy that does not respect the Vary header and for the attacker to benefit from responses that contain a cookie. Under typical public–facing deployments this risk is mitigated unless a caching layer injects or stores cookies for authenticated sessions, in which case the threat becomes more realistic.