ZDF
Sign inSign up

Vulnerabilities

Security fix · CVE-2026-114137

Django REST framework is a toolkit for building Web APIs.

Published Oct 21, 2026 · catalog updated Oct 22, 2026 · Django REST framework is

Last checked Nov 2, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-114137. EPSS is 0.51%. Act only if a listed version of Django REST framework is is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Django REST framework is).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.4
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.51%
Remediation
Version ranges on file
Affected products
PyPI djangorestframework · package pip · pip djangorestframework · pypi djangorestframework

### Summary Deleting an authentication token through silently deletes nothing. The call raises no exception and reports success, the database row survives, and the token keeps authenticating. Any application, admin integration or operational script that revokes credentials by calling on a instance believes it has revoked a token that is still live. ### Details overrides to return the user id ( ): The concrete model keys on , not on an integer id. builds its delete query from , so it emits: That matches a user id against the 40-character key column. Nothing matches, nothing raises, and the call returns . DRF already ships two workarounds for this same identity mismatch instead of a fix. In , re-fetches the concrete row: and sets with the comment "Actions not compatible with mapped IDs" ( ). The shipped admin path is therefore safe, and every other caller of is not. Nothing in the API signals the difference. was added by (PR #7341, "Adjusted token admin to map to user ID"), first released in 3.12.0. A fix would drop the override, or give a that operates on the concrete row, or raise instead of silently reporting zero deletions. ### PoC Save as and run it. Observed output: The control is what makes the trigger meaningful: it proves the row was deletable and the credential check live, so the 200 after the proxy delete is a failed revocation and not a broken harness. Reproduced identically on Django 6.1 and 5.2.17 LTS, so this is not a recent Django regression. ### Impact Failed credential revocation. An operator who revokes a token through a instance, and receives no error, leaves a live credential in circulation indefinitely, because DRF auth tokens do not expire on their own. Whoever holds that token benefits: a departed employee, a rotated integration, a device believed to be deprovisioned, or an attacker whose access was thought to have been cut during incident response. No untrusted input reaches this code path, which is why the vector is scored . Exploitation depe

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • PyPI djangorestframework3.12.0 → 3.18.2
  • package pipversion unspecified
  • pip djangorestframework>= 3.12.0, < 3.18.2
  • pypi djangorestframeworkversion unspecified

How to fix CVE-2026-114137

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-114137. EPSS is 0.51%. Act only if a listed version of Django REST framework is is installed.

Which versions are affected?

Compare what you have installed with 3.12.0 → 3.18.2, >= 3.12.0, < 3.18.2. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-390; CWE-613: Insufficient Session Expiration. EPSS 0.51%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Django security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 21, 2026 · NIST NVD

    Detected

    Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete() in rest_framework/authtoken/models.py uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, so Django issues a deletion query that matches no row and reports zero deletions without raising an error. Applications, administrative integrations, or operationa

  2. Oct 22, 2026 · GitHub Advisory Database

    Updated

    ### Summary Deleting an authentication token through silently deletes nothing. The call raises no exception and reports success, the database row survives, and the token keeps authenticating. Any application, admin integration or operational script that revokes credentials by calling on a instance believes it has revoked a token that is still live. ### Details overrides to return the user id ( ):

  3. Oct 22, 2026 · PyPA Advisory Database

    Fix available

    djangorestframework fixed in 3.18.2

  4. Oct 22, 2026 · PyPA Advisory Database

    Fix available

    djangorestframework fixed in 3.18.2

  5. Oct 22, 2026 · PyPA Advisory Database

    Updated

    ### Summary Deleting an authentication token through silently deletes nothing. The call raises no exception and reports success, the database row survives, and the token keeps authenticating. Any application, admin integration or operational script that revokes credentials by calling on a instance believes it has revoked a token that is still live. ### Details overrides to return the user id ( ):

Sources

  • CVE.orgVulnerability recordCVE-2026-114137

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-114137

    30-day exploitation probability 0.51%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-xw6w-gcfp-cf8m

    Django REST framework: TokenProxy.delete() reports success and revokes nothing

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-114137

    Deleting an authentication token through TokenProxy silently deletes nothing. The call raises no exception and reports success, the database row survives, and the token keeps authenticating. Any application, admin integration or operational script that revokes credentials by calling .delete() on a TokenProxy instance believes it has revoked a token that is still live.

    advisories.gitlab.com
  • NIST NVDVulnerability recordCVE-2026-114137

    Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete() in rest_framework/authtoken/models.py uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, so Django issues a deletion query that matc

    nvd.nist.gov
  • PyPA Advisory DatabasePackage advisoryGHSA-xw6w-gcfp-cf8m

    Django REST framework: TokenProxy.delete() reports success and revokes nothing

    osv.dev
  • Snyk Vulnerability DatabasePackage advisorySNYK-PYTHON-DJANGORESTFRAMEWORK-21431457

    Insufficient Session Expiration

    security.snyk.io

References

Freshness

Last verified in this catalog Nov 2, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSNov 2, 2026
  • Snyk Vulnerability DatabaseOct 24, 2026
  • GitHub Advisory DatabaseOct 23, 2026
  • GitLab Advisory DatabaseOct 23, 2026
  • PyPA Advisory DatabaseOct 23, 2026
  • CVE.orgOct 22, 2026
  • NIST NVDOct 22, 2026