{"api_version":"1","generated_at":"2026-10-22T23:39:45+00:00","cve":"CVE-2026-19896","urls":{"html":"https://cve.report/CVE-2026-19896","api":"https://cve.report/api/cve/CVE-2026-19896.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-19896","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-19896"},"summary":{"title":"mangroup dtale Flask Session Cookie app.py build_secret_key random values","description":"A flaw has been found in mangroup dtale up to 3.22.0. This vulnerability affects the function build_secret_key of the file dtale/app.py of the component Flask Session Cookie. This manipulation causes insufficiently random values. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.","state":"PUBLISHED","assigner":"VulDB","published_at":"2026-08-15 15:16:37","updated_at":"2026-08-20 12:48:31"},"problem_types":["CWE-310","CWE-330","CWE-330 Insufficiently Random Values","CWE-310 Cryptographic Issues"],"metrics":[{"version":"4.0","source":"cna@vuldb.com","type":"Secondary","score":"2.9","severity":"LOW","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.9,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}},{"version":"4.0","source":"CNA","type":"DECLARED","score":"6.3","severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","data":{"baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","version":"4.0"}},{"version":"3.1","source":"cna@vuldb.com","type":"Secondary","score":"3.7","severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"3.7","severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R","data":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R","version":"3.1"}},{"version":"3.0","source":"CNA","type":"DECLARED","score":"3.7","severity":"LOW","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R","data":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R","version":"3.0"}},{"version":"2.0","source":"cna@vuldb.com","type":"Secondary","score":"2.6","severity":"","vector":"AV:N/AC:H/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:P/I:N/A:N","baseScore":2.6,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"2.0","source":"CNA","type":"DECLARED","score":"2.6","severity":"","vector":"AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR","data":{"baseScore":2.6,"vectorString":"AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR","version":"2.0"}}],"references":[{"url":"https://vuldb.com/vuln/390086/cti","name":"https://vuldb.com/vuln/390086/cti","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/man-group/dtale/issues/960","name":"https://github.com/man-group/dtale/issues/960","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://vuldb.com/vuln/390086","name":"https://vuldb.com/vuln/390086","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://vuldb.com/cve/CVE-2026-19896","name":"https://vuldb.com/cve/CVE-2026-19896","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://vuldb.com/submit/870672","name":"https://vuldb.com/submit/870672","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/man-group/dtale/pull/963","name":"https://github.com/man-group/dtale/pull/963","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19896","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19896","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"mangroup","product":"dtale","version":"affected 3.0","platforms":[]},{"source":"CNA","vendor":"mangroup","product":"dtale","version":"affected 3.1","platforms":[]},{"source":"CNA","vendor":"mangroup","product":"dtale","version":"affected 3.2","platforms":[]},{"source":"CNA","vendor":"mangroup","product":"dtale","version":"affected 3.3","platforms":[]},{"source":"CNA","vendor":"mangroup","product":"dtale","version":"affected 3.4","platforms":[]},{"source":"CNA","vendor":"mangroup","product":"dtale","version":"affected 3.5","platforms":[]},{"source":"CNA","vendor":"mangroup","product":"dtale","version":"affected 3.6","platforms":[]},{"source":"CNA","vendor":"mangroup","product":"dtale","version":"affected 3.7","platforms":[]},{"source":"CNA","vendor":"mangroup","product":"dtale","version":"affected 3.8","platforms":[]},{"source":"CNA","vendor":"mangroup","product":"dtale","version":"affected 3.9","platforms":[]},{"source":"CNA","vendor":"mangroup","product":"dtale","version":"affected 3.10","platforms":[]},{"source":"CNA","vendor":"mangroup","product":"dtale","version":"affected 3.11","platforms":[]},{"source":"CNA","vendor":"mangroup","product":"dtale","version":"affected 3.12","platforms":[]},{"source":"CNA","vendor":"mangroup","product":"dtale","version":"affected 3.13","platforms":[]},{"source":"CNA","vendor":"mangroup","product":"dtale","version":"affected 3.14","platforms":[]},{"source":"CNA","vendor":"mangroup","product":"dtale","version":"affected 3.15","platforms":[]},{"source":"CNA","vendor":"mangroup","product":"dtale","version":"affected 3.16","platforms":[]},{"source":"CNA","vendor":"mangroup","product":"dtale","version":"affected 3.17","platforms":[]},{"source":"CNA","vendor":"mangroup","product":"dtale","version":"affected 3.18","platforms":[]},{"source":"CNA","vendor":"mangroup","product":"dtale","version":"affected 3.19","platforms":[]},{"source":"CNA","vendor":"mangroup","product":"dtale","version":"affected 3.20","platforms":[]},{"source":"CNA","vendor":"mangroup","product":"dtale","version":"affected 3.21","platforms":[]},{"source":"CNA","vendor":"mangroup","product":"dtale","version":"affected 3.22.0","platforms":[]}],"timeline":[{"source":"CNA","time":"2026-08-14T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"source":"CNA","time":"2026-08-14T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"source":"CNA","time":"2026-08-14T21:02:35.000Z","lang":"en","value":"VulDB entry last update"}],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"ZAST.AI (VulDB User)","lang":"en"},{"source":"CNA","value":"VulDB CNA Team","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"19896","cve":"CVE-2026-19896","epss":"0.003080000","percentile":"0.235710000","score_date":"2026-08-20","updated_at":"2026-08-21 00:13:52"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-19896","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-08-18T02:19:05.809749Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-08-18T02:19:15.776Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"cpes":["cpe:2.3:a:mangroup:dtale:*:*:*:*:*:*:*:*"],"modules":["Flask Session Cookie"],"product":"dtale","vendor":"mangroup","versions":[{"status":"affected","version":"3.0"},{"status":"affected","version":"3.1"},{"status":"affected","version":"3.2"},{"status":"affected","version":"3.3"},{"status":"affected","version":"3.4"},{"status":"affected","version":"3.5"},{"status":"affected","version":"3.6"},{"status":"affected","version":"3.7"},{"status":"affected","version":"3.8"},{"status":"affected","version":"3.9"},{"status":"affected","version":"3.10"},{"status":"affected","version":"3.11"},{"status":"affected","version":"3.12"},{"status":"affected","version":"3.13"},{"status":"affected","version":"3.14"},{"status":"affected","version":"3.15"},{"status":"affected","version":"3.16"},{"status":"affected","version":"3.17"},{"status":"affected","version":"3.18"},{"status":"affected","version":"3.19"},{"status":"affected","version":"3.20"},{"status":"affected","version":"3.21"},{"status":"affected","version":"3.22.0"}]}],"credits":[{"lang":"en","type":"reporter","value":"ZAST.AI (VulDB User)"},{"lang":"en","type":"coordinator","value":"VulDB CNA Team"}],"descriptions":[{"lang":"en","value":"A flaw has been found in mangroup dtale up to 3.22.0. This vulnerability affects the function build_secret_key of the file dtale/app.py of the component Flask Session Cookie. This manipulation causes insufficiently random values. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance."}],"metrics":[{"cvssV4_0":{"baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","version":"4.0"}},{"cvssV3_1":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R","version":"3.1"}},{"cvssV3_0":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R","version":"3.0"}},{"cvssV2_0":{"baseScore":2.6,"vectorString":"AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR","version":"2.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-330","description":"Insufficiently Random Values","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-310","description":"Cryptographic Issues","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-15T14:15:08.291Z","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB"},"references":[{"name":"VDB-390086 | mangroup dtale Flask Session Cookie app.py build_secret_key random values","tags":["vdb-entry","technical-description"],"url":"https://vuldb.com/vuln/390086"},{"name":"VDB-390086 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"],"url":"https://vuldb.com/vuln/390086/cti"},{"name":"CVE-2026-19896 | CVE Analysis and Report","tags":["third-party-advisory"],"url":"https://vuldb.com/cve/CVE-2026-19896"},{"name":"Submit #870672 | man-group dtale <=3.22.0 Cryptographically Weak PRNG","tags":["third-party-advisory"],"url":"https://vuldb.com/submit/870672"},{"tags":["exploit","issue-tracking"],"url":"https://github.com/man-group/dtale/issues/960"},{"tags":["issue-tracking","patch"],"url":"https://github.com/man-group/dtale/pull/963"}],"timeline":[{"lang":"en","time":"2026-08-14T00:00:00.000Z","value":"Advisory disclosed"},{"lang":"en","time":"2026-08-14T02:00:00.000Z","value":"VulDB entry created"},{"lang":"en","time":"2026-08-14T21:02:35.000Z","value":"VulDB entry last update"}],"title":"mangroup dtale Flask Session Cookie app.py build_secret_key random values","x_generator":["VulDB PVTS v202608"]}},"cveMetadata":{"assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","assignerShortName":"VulDB","cveId":"CVE-2026-19896","datePublished":"2026-08-15T14:15:08.291Z","dateReserved":"2026-08-14T18:57:25.195Z","dateUpdated":"2026-08-18T02:19:15.776Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-15 15:16:37","lastModifiedDate":"2026-08-20 12:48:31","problem_types":["CWE-310","CWE-330","CWE-330 Insufficiently Random Values","CWE-310 Cryptographic Issues"],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.9,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:P/I:N/A:N","baseScore":2.6,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":4.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-18T02:19:05.809749Z","id":"CVE-2026-19896","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"19896","Ordinal":"1","Title":"mangroup dtale Flask Session Cookie app.py build_secret_key rand","CVE":"CVE-2026-19896","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"19896","Ordinal":"1","NoteData":"A flaw has been found in mangroup dtale up to 3.22.0. This vulnerability affects the function build_secret_key of the file dtale/app.py of the component Flask Session Cookie. This manipulation causes insufficiently random values. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.","Type":"Description","Title":"mangroup dtale Flask Session Cookie app.py build_secret_key rand"}]}}}