CVE-2026-19896 mangroup dtale Flask Session Cookie app.py build_secret_key random values
Attackers can predict Flask session cookies due to weak random key generation, potentially bypassing authentication in dtale.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-19896?
CVE-2026-19896 is a medium-severity vulnerability in mangroup dtale, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw has been found in mangroup dtale up to 3.22.0. This vulnerability affects the function build_secret_key of the file dtale/app.py of the component Flask Session Cookie. This manipulation causes insufficiently random values. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.
Which versions are affected by CVE-2026-19896?
How do I fix CVE-2026-19896?
No fix has been published for CVE-2026-19896 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-19896 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-19896 exists.
Sources
Also known as GHSA-q2jc-92rc-h772.