CVE-2019-14806: Pallets Werkzeug Insufficient Debugger PIN Randomness
Summary
CVE-2019-14806: Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id. Affects werkzeug across 2 version ranges.
< 0.15.3
< 00bc43b1672e662e5e3b8cecd79e67fc968fa246
Fixed in 00bc43b1672e662e5e3b8cecd79e67fc968fa246. How to fix ↓
Also tracked for
- python-werkzeug · Debian:11
The same CVE-2019-14806 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pallets Werkzeug is a Python library that provides utilities for web development. It is commonly used as a part of the Flask web framework. Werkzeug allows developers to handle HTTP requests and responses, routing, and other web-related tasks. However, versions of Werkzeug prior to 0.15.3 are vulnerable to an issue when used with Docker containers. This vulnerability arises due to insufficient randomness in the debugger PIN generation, as Docker containers share the same machine id.
Vulnerability Detail
The vulnerability in Pallets Werkzeug allows an attacker with access to a Docker container to guess the debugger PIN used by Werkzeug. This could potentially lead to unauthorized access to the debugging interface, allowing the attacker to execute arbitrary code or gain sensitive information. The lack of randomness in the PIN generation increases the likelihood of successful brute-force attacks. It is important to note that this vulnerability only affects Werkzeug when used in conjunction with Docker containers.
How To Fix
Latest published version: 3.1.9 as of 22 Oct 2026
pip install --upgrade "werkzeug==3.1.9"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
00bc43b1672e662e5e3b8cecd79e67fc968fa246
This is the first release that contains the fix.
pip install --upgrade "werkzeug==00bc43b1672e662e5e3b8cecd79e67fc968fa246"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of Werkzeug to ensure the security of the application.
Conclusion
Pallets Werkzeug versions prior to 0.15.3 are vulnerable to an insufficient debugger PIN randomness issue when used with Docker containers. This vulnerability could allow unauthorized access to the debugging interface, potentially leading to the execution of arbitrary code or access to sensitive information. To mitigate this risk, it is crucial to upgrade to Werkzeug version 0.15.3 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for werkzeug →
FAQ
Pallets Werkzeug is a Python library used for web development. It provides utilities for handling HTTP requests and responses, routing, and other web-related tasks. It is commonly used with the Flask web framework.
The vulnerability allows an attacker with access to a Docker container to guess the debugger PIN used by Werkzeug. This could lead to unauthorized access to the debugging interface and potential execution of arbitrary code or access to sensitive information.
To fix this vulnerability, it is recommended to upgrade to Werkzeug version 0.15.3 or later. This version includes a fix for the insufficient debugger PIN randomness issue. Update your dependencies by running 'pip install --upgrade werkzeug'.
No, there is no known workaround for this vulnerability. It is crucial to update to the fixed version of Werkzeug to ensure the security of your application.
No, this vulnerability only affects versions of Werkzeug prior to 0.15.3 when used with Docker containers. It is recommended to upgrade to the fixed version to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for werkzeug.
