What is CVE-2026-19896?

CVE-2026-19896 is a low-severity vulnerability in Mangroup Dtale, classified under Cryptographic Issues. CVSS score: 3.7/10. Published 2026-08-15.

How severe is CVE-2026-19896?

Low severity. CVSS v3 base score is 3.7 out of 10.

Vulnerability in Mangroup Dtale

CVE-2026-19896

A flaw has been found in mangroup dtale up to 3.22.0. This vulnerability affects the function build_secret_key of the file dtale/app.py of the component Flask Session Cookie. This manipulation causes insufficiently random values. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.

Vulnerability class: POODLE (CVE-2014-3566)

CVSS v3 metric

CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Mangroup Dtale — versions 3.0, 3.1, 3.2

Weakness classification (CWE)

References

cna@vuldb.com (technical-description, vdb-entry)
cna@vuldb.com (signature, permissions-required)
cna@vuldb.com (third-party-advisory)
cna@vuldb.com (third-party-advisory)
cna@vuldb.com (issue-tracking, exploit)
cna@vuldb.com (issue-tracking, patch)

Frequently asked questions

What is CVE-2026-19896?: CVE-2026-19896 is a low-severity vulnerability in Mangroup Dtale, classified under Cryptographic Issues. CVSS score: 3.7/10. Published 2026-08-15.
How severe is CVE-2026-19896?: Low severity. CVSS v3 base score is 3.7 out of 10.