PT-2026-61041 · Pypi · Django Tastypie

Galaxyn · CVE-2026-16207 · Published 2026-07-19 · Updated 2026-07-19

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions django-tastypie versions prior to 0.15.2

Description An information disclosure issue exists in the ApiKeyAuthentication() function within the tastypie/authentication.py file. A remote attacker can manipulate the system to use the GET request method with sensitive query strings, potentially exposing confidential data. This attack is characterized by high complexity and is considered difficult to exploit.

Recommendations As a temporary workaround, restrict the use of the ApiKeyAuthentication() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-598

Related Identifiers

CVE-2026-16207

Affected Products

Django Tastypie

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-16207 · Security Note
• https://github.com/django-tastypie/django-tastypie/issues/1700 · Note
• https://vuldb.com/vuln/380023/cti · Note
• https://twitter.com/VulmonFeeds/status/2078710148743184442 · Twitter Post
• https://vuldb.com/submit/857924 · Note
• https://github.com/django-tastypie/django-tastypie · Note
• https://vuldb.com/cve/CVE-2026-16207 · Note
• https://vuldb.com/vuln/380023 · Note