Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-16207— django-tastypie authentication.py ApiKeyAuthentication get request method with sensitive query strings

Quick assessment

Affected

n/a django-tastypie

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

django-tastypie django-tastypie是django-tastypie公司开源的一个创建Web API的框架。 django-tastypie 0.15.1及之前版本存在信息泄露漏洞，该漏洞源于文件tastypie/authentication.py中ApiKeyAuthentication函数的GET请求方法使用了敏感查询字符串，可能导致信息泄露。

CVSS 3.7 · Low EPSS 0.62% · P50 Updated Jul 20, 2026

Possible ATT&CK Techniques 1 AI

T1552.004 · Private Keys

Affected Version Matrix 2

Vendor	Product	Version Range	Status
n/a	django-tastypie	`0.15.0`	affected
		`0.15.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-16207

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

django-tastypie authentication.py ApiKeyAuthentication get request method with sensitive query strings

Source: CVE Program / CVE List V5

Vulnerability Description

A vulnerability was detected in django-tastypie up to 0.15.1. Impacted is the function ApiKeyAuthentication of the file tastypie/authentication.py. The manipulation results in use of get request method with sensitive query strings. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The project was informed of the problem early through an issue report but has not responded yet.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

通过GET请求中的查询字符串导致的信息暴露

Source: CVE Program / CVE List V5

Vulnerability Title

django-tastypie 信息泄露漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	django-tastypie	0.15.0	`cpe:2.3:a:django-tastypie:django-tastypie::::::::`

II. Public POCs for CVE-2026-16207

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-16207

请登录查看更多情报信息。

News Coverage for CVE-2026-16207 (1)

🔗 ApiKeyAuthentication accepts credentials from URL parameters and CacheThrottle can be bypassed with concurrent requests · Issue #1700 · django-tastypie/django-tastypie Read full article issue-tracking

Other References for CVE-2026-16207 (1)

🔗 GitHub - django-tastypie/django-tastypie: Creating delicious APIs for Django apps since 2010. · GitHub product

https://www.cve.org/CVERecord?id=CVE-2026-16207

Same Patch Batch · n/a · 2026-07-19 · 4 CVEs total

CVE-2026-16209	7.3 HIGH	Gerapy Project Upload Endpoint views.py missing authentication
CVE-2026-16208	5.0 MEDIUM	django-tastypie throttle.py CacheDBThrottle race condition
CVE-2026-16211	2.6 LOW	allegro Hostname Allocation assets.py AssetLastHostname.increment_hostname race condition

IV. Related Vulnerabilities

Same product: django-tastypie

CVE-2026-16208
django-tastypie throttle.py CacheDBThrottle race condition

Same vendor: n/a

Same weakness: CWE-598