CVE-2026-16207
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A vulnerability was found in django-tastypie up to version 0.15.1 in the ApiKeyAuthentication function within tastypie/authentication.py. The issue involves using the GET method with sensitive query strings, potentially leaking API keys. The attack is remote but has high complexity and is considered difficult to exploit.
Risk Assessment
The risk involves potential interception of sensitive authentication data (e.g., API keys) transmitted in GET request strings, which could allow unauthorized access to resources protected by the library.
Recommendation
It is recommended to immediately update django-tastypie to the latest available version that fixes this vulnerability. Until an update is applied, avoid using the GET method to transmit sensitive data in requests.
Original NVD description (English source)
A vulnerability was detected in django-tastypie up to 0.15.1. Impacted is the function ApiKeyAuthentication of the file tastypie/authentication.py. The manipulation results in use of get request method with sensitive query strings. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The project was informed of the problem early through an issue report but has not responded yet.