All Werkzeug CVEs — Complete Vulnerability History

Last updated: April 1, 2026 · Data: OSV Database

Werkzeug is Flask's WSGI toolkit. CVEs here affect all Flask applications since Werkzeug handles request parsing, routing, and debugging. The debugger CVE (2023) is particularly serious.

Full CVE history

Current safe version: 3.0.3

# Before

"Werkzeug==2.0.0"

# After

"Werkzeug==3.0.3"

Then run: pip install -r requirements.txt

Werkzeug CVEs — Flask's WSGI toolkit

Werkzeug is the WSGI utility library that Flask is built on. Werkzeug vulnerabilities directly affect all Flask applications. When pip-audit flags Werkzeug, your Flask app is exposed.

Known Werkzeug CVEs

Fix Werkzeug

# Safe version — 3.0.6 or later
pip install werkzeug --upgrade

# Pin in requirements.txt
werkzeug>=3.0.6

pip install -r requirements.txt

# Verify
pip show werkzeug | grep Version

CVE-2024-34069 — RCE via debugger PIN bypass

This is the highest-risk Werkzeug CVE. The Werkzeug debugger PIN can be bypassed if an attacker knows the machine ID and MAC address — both often obtainable via path traversal. This gives full RCE. Only affects apps running with debug mode enabled. In production, debug mode must always be off.