CVE-2026-8404 is a vulnerability in Django's UpdateCacheMiddleware affecting versions 5.2 before 5.2.15 and 6.0 before 6.0.6. The middleware does not perform case-insensitive matching of Cache-Control response directives, leading to improper caching behavior when Cache-Control headers use uppercase or mixed-case values. This can result in unauthorized reading of cached responses that should have been excluded from caching. Earlier unsupported Django versions may also be affected but were not evaluated. The issue is categorized as CWE-178 (Improper Handling of Case Sensitivity).

The vulnerability allows remote attackers to read cached HTTP responses that were incorrectly cached due to case-sensitive matching of Cache-Control headers. This could lead to unintended information disclosure. The CVSS score is 3.1 (low), indicating limited impact primarily related to confidentiality. There are no known exploits in the wild at this time.

Patch status is not confirmed in the provided data. Users should consult the official Django security advisory for updates and apply any available patches or updates to versions 5.2.15 or later and 6.0.6 or later. Until patched, review Cache-Control header usage to ensure consistent casing or consider disabling caching middleware if feasible. No vendor advisory content was provided to indicate if no action is required or if the issue is already mitigated.