CVE-2026-16207 Details
Description
A vulnerability was detected in django-tastypie up to 0.15.1. Impacted is the function ApiKeyAuthentication of the file tastypie/authentication.py. The manipulation results in use of get request method with sensitive query strings. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability exists in django-tastypie versions through 0.15.1, specifically within the ApiKeyAuthentication function in authentication.py. This issue allows for the remote exploitation of GET or POST request methods to include sensitive query strings, such as API credentials. The vulnerability arises from the authentication method's acceptance of credentials via URL parameters when no Authorization header is provided, potentially leading to API key leakage.
It is recommended to remove the fallback for GET/POST credential acceptance in ApiKeyAuthentication, or to require an explicit opt-in for this feature. Throttle management should be improved with atomic cache operations to prevent bypassing rate limits.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 19, 2026CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/django-tastypie/django-tastypie/ | [email protected] | ProductSource CodeVendor |
| https://github.com/django-tastypie/django-tastypie/issues/1700 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-16207 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/857924 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/380023 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/380023/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-598 | Use of GET Request Method With Sensitive Query Strings | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| django-tastypie | <= 0.15.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 19, 2026 | New CVE Received | [email protected] |