How a Leaked Flask Secret Enabled Remote Code Execution on Google Dev Sites

A security researcher detailed how Google’s developer documentation sites allowed remote code execution through a flawed session management configuration. The issue involved the use of Python pickle serialization for Flask session cookies, combined with a signing key that was exposed within the cookie payload itself. This misconfiguration turned a standard authentication flow into a vector for unauthenticated command execution.

How did the researcher discover the vulnerability?

The investigation began with mapping the OAuth flow used across Google’s developer documentation sites. When a user visited the authorization endpoint, the server set a Flask session cookie before redirecting to the sign-in page. The researcher noted that the cookie was significantly larger than expected, measuring approximately 1,200 bytes. This size suggested it contained more data than a typical CSRF token and return URL, prompting further analysis of its contents.

What was stored inside the session cookie?

Decoding the cookie revealed a pickle-serialized object containing an OAuth2WebServerFlow instance. This object included Google’s OAuth client ID and client secret in plaintext. More critically, the researcher found that the same client secret was being used as the Flask SECRET_KEY to sign the cookie. This meant the signing key was publicly available within the very payload it was supposed to protect, effectively breaking the integrity of the session.

How did this lead to remote code execution?

Because the signing key was public, an attacker could forge valid session cookies with arbitrary content. The callback handler on the server deserialized the flow object from the session using pickle.loads. Since pickle can execute arbitrary Python code during deserialization, the researcher demonstrated that they could inject a malicious payload. By crafting a cookie that called time.sleep, they proved that unauthenticated remote code execution was possible without needing valid credentials.

What steps should developers take to mitigate this?

Developers should ensure that Flask session cookies use a strong, random secret key that is never exposed in the payload or derived from other secrets like OAuth client keys. Additionally, using pickle for serializing untrusted data is dangerous; developers should switch to safer serialization formats like JSON. Organizations should also audit their session management configurations to ensure that signing keys remain confidential and are not transmitted to clients.

What to do and how to stay safe: Google

• Rotate any OAuth client secrets that may have been exposed in session cookies.
• Audit Flask applications to ensure SECRET_KEY is not derived from other credentials.
• Replace pickle serialization with safer alternatives like JSON for session data.
• Monitor server logs for unexpected process executions or unusual timing delays.

Step-by-step guide: Patch Management: Why Updates Fail and How to Fix It

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What CVE ID is associated with this Google vulnerability?

The source material does not mention a CVE ID for this specific Google Flask session vulnerability.

Is this issue related to the Ghostscript vulnerability mentioned in the source?

No, the Ghostscript vulnerability (CVE-2026-39919) is a separate issue involving PDF processing and is not related to the Google Flask session flaw.

Did the researcher exploit this vulnerability on production servers?

No, the researcher stated they did not run commands on Google’s production environment, instead proving the concept using a time-based delay payload.