EUVD-2026-45418
GHSA-vv2j-8w59-8f8g
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but requires attacker access to logs or traffic (AC:H); no privileges or interaction needed; confidentiality impact limited to API key disclosure only.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was detected in django-tastypie up to 0.15.1. Impacted is the function ApiKeyAuthentication of the file tastypie/authentication.py. The manipulation results in use of get request method with sensitive query strings. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Sensitive API key credential exposure in django-tastypie up to 0.15.1 stems from the ApiKeyAuthentication class transmitting secrets via GET request query strings, making them visible in server access logs, proxy logs, browser history, and HTTP Referer headers. The flaw is a classic CWE-598 design error rooted in the authentication.py implementation and is remotely triggerable against any deployment using the ApiKeyAuthentication backend. No patch has been released; the project was notified via GitHub issue #1700 but has not yet responded. No public exploit code or CISA KEV listing exists at time of analysis, though the information disclosure risk is real in any environment where logs or network traffic are accessible to adversaries.
Technical ContextAI
Django Tastypie is a REST API extension for the Django web framework, providing resource-level CRUD APIs over HTTP. The affected component is the ApiKeyAuthentication class in tastypie/authentication.py, which is responsible for verifying client identity via API keys. CWE-598 (Use of GET Request Method With Sensitive Query Strings) describes the root cause: the implementation accepts or constructs API key credentials embedded in the query string portion of GET request URLs (e.g., ?api_key=secret). Unlike HTTP headers or POST body content, URL query strings are routinely written to web server access logs, CDN and reverse proxy logs, browser history, and transmitted in HTTP Referer headers to third-party resources on the page. Even over HTTPS, the server-side receives and may log the full URL including query parameters. The CPE identifier (cpe:2.3:a:n/a:django-tastypie:*:*:*:*:*:*:*:*) covers all versions up to and including 0.15.1.
RemediationAI
No vendor-released patch has been identified at time of analysis; the upstream project has not responded to the disclosure filed at https://github.com/django-tastypie/django-tastypie/issues/1700. As a primary compensating control, applications using ApiKeyAuthentication should be modified to require clients to submit API keys exclusively via HTTP headers (e.g., Authorization header) rather than query string parameters - this can be enforced at the application layer by rejecting any request that includes the key in the URL. A secondary control is to configure web server and proxy log sanitization rules to redact or exclude api_key query string values from logs, though this treats the symptom rather than the cause. Operators should audit existing log archives for inadvertent API key exposure and rotate any keys that may have been captured. If migration away from ApiKeyAuthentication to token-header-based schemes (e.g., Django REST Framework's token auth) is feasible, that is the most durable fix. Monitor https://github.com/django-tastypie/django-tastypie/ for a patched release.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today