CVE-2026-114137: Django REST framework: TokenProxy.delete() reports success and revokes nothing
Deleting an authentication token through TokenProxy silently deletes nothing. The call raises no
exception and reports success, the database row survives, and the token keeps authenticating. Any
application, admin integration or operational script that revokes credentials by calling .delete()
on a TokenProxy instance believes it has revoked a token that is still live.
References
- github.com/advisories/GHSA-xw6w-gcfp-cf8m
- github.com/encode/django-rest-framework/commit/af3fabfd517307fbc5d500fba1ab8f6e25f220b0
- github.com/encode/django-rest-framework/releases/tag/3.18.2
- github.com/encode/django-rest-framework/security/advisories/GHSA-xw6w-gcfp-cf8m
- nvd.nist.gov/vuln/detail/CVE-2026-114137
Code Behaviors & Features
Detect and mitigate CVE-2026-114137 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →