Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution
Priority MEDIUM 41CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Tampering
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 7 fixed, 10 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-352.
Summary
Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03397 88th percentileScored 2026-11-07
Fix Partial werkzeug (pallets): 3.0.3Werkzeug (PyPI): 3.0.3Red Hat: 10 advisoriesRed Hat: 7 fixed, 10 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pallets | werkzeug | before 3.0.3 | 3.0.3 | Patch available | CNA |
| — | Werkzeug (PyPI) | before 3.0.3 | 3.0.3 | Patch available | GHSA-2g68-c3qc-8985 |
- werkzeug Vendorpallets Affected before 3.0.3 Fixed in 3.0.3 Patch available CNA
- Werkzeug (PyPI) Vendor— Affected before 3.0.3 Fixed in 3.0.3 Patch available GHSA-2g68-c3qc-8985
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:palletsprojects:werkzeug:*:*:*:*:*:*:*:* | before 3.0.3 | Vulnerable | pallets |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* | 40 | Vulnerable | Fedoraproject |
- cpe:2.3:a:palletsprojects:werkzeug:*:*:*:*:*:*:*:* Versions before 3.0.3 Vulnerable ·pallets
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* Versions 40 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA werkzeug (pallets) Fixed in 3.0.3
- Fix · GHSA-2g68-c3qc-8985 Werkzeug (PyPI) Fixed in 3.0.3 Advisory →
Red Hat 10 advisories
- RHSA-2025:9340 Released 2025-06-23 · Red Hat rating ImportantUpdated 7.1 container image is now available in the Red Hat Ecosystem Catalog.
- Red Hat Ceph Storage 7.1 Tools rhceph/grafana-rhel9, rhceph/rhceph-7-rhel9, rhceph/rhceph-promtail-rhel9
- RHSA-2025:4664 Released 2025-05-07 · Red Hat rating ImportantRed Hat Ceph Storage 7.1 security, bug fix, and enhancement updates
- Red Hat Ceph Storage 7.1 Tools ceph-2:18.2.1-329.el8cp, ceph-2:18.2.1-329.el9cp, ceph-base-2:18.2.1-329.el8cp +47
- RHSA-2024:10696 Released 2024-12-02 · Red Hat rating ImportantRed Hat OpenStack Platform 16.2 (python-werkzeug) security update
- Red Hat OpenStack Platform 16.2 python-werkzeug-0.14.1-13.el8ost, python3-werkzeug-0.14.1-13.el8ost
Show 7 more Red Hat advisories
- RHSA-2024:9976 Released 2024-11-21 · Red Hat rating ImportantRHOSP 17.1.4 (python-werkzeug) security update
- Red Hat OpenStack Platform 17.1 python-werkzeug-2.0.1-7.el9ost, python3-werkzeug-2.0.1-7.el9ost
- RHSA-2024:9975 Released 2024-11-21 · Red Hat rating ImportantRHOSP 17.1.4 (python-werkzeug) security update
- Red Hat OpenStack Platform 17.1 python-werkzeug-2.0.1-9.el8ost, python3-werkzeug-2.0.1-9.el8ost
- RHSA-2024:6406 Released 2024-09-11 · Red Hat rating ImportantOpenShift Container Platform 4.14.36 security update
- Red Hat OpenShift Container Platform 4.14 openshift4/cloud-network-config-controller-rhel8, openshift4/driver-toolkit-rhel9, openshift4/egress-router-cni-rhel8 +47
- RHSA-2024:6016 Released 2024-09-05 · Red Hat rating ImportantOpenShift Container Platform 4.15.30 packages and security update
- Ironic content for Red Hat OpenShift Container Platform 4.15 python-werkzeug-2.2.3-3.el9, python3-werkzeug-2.2.3-3.el9
- RHSA-2024:5810 Released 2024-08-29 · Red Hat rating ImportantOpenShift Container Platform 4.12.64 security update
- Ironic content for Red Hat OpenShift Container Platform 4.12 python-jinja2-3.0.1-3.el9.1, python-werkzeug-2.0.3-6.el9, python3-jinja2-3.0.1-3.el9.1 +1
- Red Hat OpenShift Container Platform 4.12 openshift-4.12.0-202408131833.p0.g1eb8682.assembly.stream.el8, openshift-4.12.0-202408131833.p0.g1eb8682.assembly.stream.el9, openshift-hyperkube-4.12.0-202408131833.p0.g1eb8682.assembly.stream.el8 +1
- RHSA-2024:5439 Released 2024-08-22 · Red Hat rating ImportantOpenShift Container Platform 4.15.28 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 openshift4/cloud-network-config-controller-rhel8, openshift4/driver-toolkit-rhel9, openshift4/egress-router-cni-rhel8 +47
- RHSA-2024:5107 Released 2024-08-13 · Red Hat rating ImportantOpenShift Container Platform 4.16.7 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 openshift4/ose-ironic-rhel9, openshift4/ose-powervs-block-csi-driver-rhel9, rhcos
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ceph Storage 5 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 6 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 16.1 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Update Infrastructure 3 for Cloud Providers | Affected | No fix planned: Out of support scope |
| Ironic content for Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2024:5810 |
| Ironic content for Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2024:6016 |
| Red Hat Ceph Storage 7.1 Tools | Fixed | RHSA-2025:4664, RHSA-2025:9340 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2024:6406 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2024:5107 |
| Red Hat OpenStack Platform 16.2 | Fixed | RHSA-2024:10696 |
| Red Hat OpenStack Platform 17.1 | Fixed | RHSA-2024:9975, RHSA-2024:9976 |
Not affected: 5 products
- Ironic content for Red Hat OpenShift Container Platform 4.12
- Red Hat Ceph Storage 7.1 Tools
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.15
- Red Hat OpenShift Container Platform 4.16
Timeline
- 2026-10-02 Threatist record created from CVE-2024-34069
- 2026-10-03 Alias added: GHSA-2g68-c3qc-8985
References
Advisory 6
- https://github.com/pallets/werkzeug/security/advisories/GHSA-2g68-c3qc-8985
- https://lists.fedoraproject.org/archives/list/[email protected]/message/HFERFN7PINV4MOGMGA3DPIXJPDCYOEJZ/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/H4SH32AM3CTPMAAEOIDAN7VU565LO4IR/
- https://security.netapp.com/advisory/ntap-20240614-0004/
- https://nvd.nist.gov/vuln/detail/CVE-2024-34069
- https://lists.debian.org/debian-lts-announce/2025/02/msg00026.html
Other 4
More pallets Werkzeug vulnerabilities
- TI-2019-10671 In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames. CVSS 3.1HIGH 7.5
- TI-2022-11856 Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers… CVSS 3.1CRITICAL 9.8
- TI-2023-10880 Werkzeug may allow high resource usage when parsing multipart form data with many fields CVSS 3.1HIGH 7.5
- TI-2024-33234 Werkzeug possible resource exhaustion when parsing file data in forms CVSS 4.0MEDIUM 6.9
- TI-2023-24778 Uncontrolled resource consumption in pallets werkzeug CVSS 3.1HIGH 8.0
- TI-2019-11011 Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN… CVSS 3.1HIGH 7.5
Sources
- CVE-2024-34069 · CVE Program
- CVE-2024-34069 · NVD
- FIRST EPSS
- GHSA-2g68-c3qc-8985 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-34069 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences