CVE-2026-19896

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-19896
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19896.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-19896
Published
2026-08-15T14:15:08.291Z
Modified
2026-08-19T03:31:26.594551237Z
Severity
  • 2.9 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
mangroup dtale Flask Session Cookie app.py build_secret_key random values
Details

A flaw has been found in mangroup dtale up to 3.22.0. This vulnerability affects the function buildsecretkey of the file dtale/app.py of the component Flask Session Cookie. This manipulation causes insufficiently random values. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "3.20"
                },
                {
                    "last_affected": "3.20"
                },
                {
                    "introduced": "3.21"
                },
                {
                    "last_affected": "3.21"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19896.json",
    "cwe_ids": [
        "CWE-310",
        "CWE-330"
    ]
}
References

Affected packages

Git / github.com/man-group/dtale

Affected ranges

Type
GIT
Repo
https://github.com/man-group/dtale
Events
Introduced
ffb6557713eff769fc4f5bd62cf8ab615448e3c2
Last affected
6379f1d7b7f8ef7301a0d88b512ed2655946a577
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "3.0"
        },
        {
            "last_affected": "3.0"
        },
        {
            "introduced": "3.1"
        },
        {
            "last_affected": "3.1"
        },
        {
            "introduced": "3.2"
        },
        {
            "last_affected": "3.2"
        },
        {
            "introduced": "3.3"
        },
        {
            "last_affected": "3.3"
        },
        {
            "introduced": "3.4"
        },
        {
            "last_affected": "3.4"
        },
        {
            "introduced": "3.5"
        },
        {
            "last_affected": "3.5"
        },
        {
            "introduced": "3.6"
        },
        {
            "last_affected": "3.6"
        },
        {
            "introduced": "3.7"
        },
        {
            "last_affected": "3.7"
        },
        {
            "introduced": "3.8"
        },
        {
            "last_affected": "3.8"
        },
        {
            "introduced": "3.9"
        },
        {
            "last_affected": "3.9"
        },
        {
            "introduced": "3.10"
        },
        {
            "last_affected": "3.10"
        },
        {
            "introduced": "3.11"
        },
        {
            "last_affected": "3.11"
        },
        {
            "introduced": "3.12"
        },
        {
            "last_affected": "3.12"
        },
        {
            "introduced": "3.13"
        },
        {
            "last_affected": "3.13"
        },
        {
            "introduced": "3.14"
        },
        {
            "last_affected": "3.14"
        },
        {
            "introduced": "3.15"
        },
        {
            "last_affected": "3.15"
        },
        {
            "introduced": "3.16"
        },
        {
            "last_affected": "3.16"
        },
        {
            "introduced": "3.17"
        },
        {
            "last_affected": "3.17"
        },
        {
            "introduced": "3.18"
        },
        {
            "last_affected": "3.18"
        },
        {
            "introduced": "3.19"
        },
        {
            "last_affected": "3.19"
        },
        {
            "introduced": "3.22.0"
        },
        {
            "last_affected": "3.22.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

3.*
3.0
3.1
3.10
3.11
3.12
3.13
3.14
3.15
3.16
3.17
3.18
3.19
3.2
3.22.0
3.3
3.4
3.5
3.6
3.7
3.8
3.9
v3.*
v3.0.0
v3.1.0
v3.1.4
v3.1.5
v3.1.6
v3.10.0
v3.11.0
v3.12.0
v3.13.0
v3.13.1
v3.14.0
v3.14.1
v3.15.1
v3.16.0
v3.17.0
v3.18.0
v3.18.2
v3.19.0
v3.19.1
v3.2.0
v3.22.0
v3.3.0
v3.4.0
v3.5.0
v3.6.0
v3.7.0
v3.8.0
v3.8.1
v3.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19896.json"