Detections
Analytics

SCA: security update for djangorestframework (GHSA-xw6w-gcfp-cf8m)

high Tenable Self-Hosted Container Security Plugin ID 476867

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete() in
 rest_framework/authtoken/models.py uses the proxy's user-id pk while the concrete Token token-string
 primary key identifies rows, so Django issues a deletion query that matches no row and reports zero
 deletions without raising an error. Applications, administrative integrations, or operational scripts that
 revoke credentials through a TokenProxy instance can therefore believe revocation succeeded while the
 token remains live and continues authenticating. DRF's own TokenAdmin.delete_model workaround is not
 affected, but other callers can leave access available indefinitely because DRF tokens do not expire
 automatically. This issue is fixed in version 3.18.2. (CVE-2026-114137)

Solution

Update the djangorestframework library and its related packages to version 3.18.2 or later.

See Also

https://github.com/advisories/GHSA-xw6w-gcfp-cf8m

Plugin Details

Severity: High

ID: 476867

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/22/2026

Updated: 10/22/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.55

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.1

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2026-114137

CVSS v3

Risk Factor: High

Base Score: 7.4

Temporal Score: 6.4

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/22/2026

Vulnerability Publication Date: 10/21/2026

Reference Information

CVE: CVE-2026-114137