CVE-2026-19896— mangroup dtale Flask Session Cookie app.py build_secret_key random values
Possible ATT&CK Techniques 1AI
T1552.004 · Private KeysGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-19896
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
mangroup dtale Flask Session Cookie app.py build_secret_key random values
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw has been found in mangroup dtale up to 3.22.0. This vulnerability affects the function build_secret_key of the file dtale/app.py of the component Flask Session Cookie. This manipulation causes insufficiently random values. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用不充分的随机数
Source: CVE Program / CVE List V5
Vulnerability Title
Man D-Tale 加密问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Man D-Tale是Man公司开源的一个 pandas 数据结构的可视化工具。 Man D-Tale 3.22.0及之前版本存在加密问题漏洞，该漏洞源于dtale/app.py文件中的build_secret_key函数在处理Flask Session Cookie时生成随机值不够随机，可能导致远程攻击者预测会话Cookie，造成信息泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-19896
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-19896
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-19896 (1)
News Coverage for CVE-2026-19896 (1)
IV. Related Vulnerabilities
Same product: dtale
- CVE-2026-19897
mangroup dtale Login Endpoint auth.py login excessive authen - CVE-2026-35052
D-Tale affected by Remote Code Execution through redis/shelf - CVE-2026-27194
D-Tale affected by Remote Code Execution through the /save-c - CVE-2024-55890
D-Tale allows Remote Code Execution through the Custom Filte - CVE-2024-45595
D-Tale allows Remote Code Execution through the Query input
Same weakness: CWE-330
- CVE-2026-18531
IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 - CVE-2026-71225
Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chu - CVE-2026-66391
Apache Wicket: leaked and missing CSP headers - CVE-2026-46351
BigBlueButton: Insecure Randomness allows to guess user's co - CVE-2026-47703
AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Ora
V. Comments for CVE-2026-19896
No comments yet