---
id: CVE-2026-114137
title: 'Django REST framework: TokenProxy.delete() reports success and revokes nothing'
summary: >-
  Django REST framework is a toolkit for building Web APIs. From 3.12.0 until
  3.18.2, TokenProxy.delete() in rest_framework/authtoken/models.py uses the
  proxy's user-id pk while the concrete Token token-string primary key
  identifies rows, …
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-390
  - CWE-613
vendor: encode
product: django-rest-framework
affected:
  - 'django-rest-framework >= 3.12.0, < 3.18.2'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-23T14:54:10.614213Z'
published: '2026-10-21'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T15:08:55.473Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114137'
references:
  - url: >-
      https://github.com/encode/django-rest-framework/security/advisories/GHSA-xw6w-gcfp-cf8m
    label: >-
      https://github.com/encode/django-rest-framework/security/advisories/GHSA-xw6w-gcfp-cf8m
  - url: >-
      https://github.com/encode/django-rest-framework/commit/af3fabfd517307fbc5d500fba1ab8f6e25f220b0
    label: >-
      https://github.com/encode/django-rest-framework/commit/af3fabfd517307fbc5d500fba1ab8f6e25f220b0
  - url: 'https://github.com/encode/django-rest-framework/releases/tag/3.18.2'
    label: 'https://github.com/encode/django-rest-framework/releases/tag/3.18.2'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114137.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-114137'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2558557'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-114137'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-114137'
  - url: 'https://github.com/encode/django-rest-framework'
  - url: 'https://github.com/advisories/GHSA-xw6w-gcfp-cf8m'
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - osv
  - pip
  - ghsa
epss: 0.00512
epssPercentile: 0.43793
aliases:
  - GHSA-xw6w-gcfp-cf8m
ecosystem: pip
patched:
  - djangorestframework 3.18.2
ingestedAt: '2026-10-21T21:13:32.893Z'
---

## Overview

Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete() in rest_framework/authtoken/models.py uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, so Django issues a deletion query that matches no row and reports zero deletions without raising an error. Applications, administrative integrations, or operational scripts that revoke credentials through a TokenProxy instance can therefore believe revocation succeeded while the token remains live and continues authenticating. DRF's own TokenAdmin.delete_model workaround is not affected, but other callers can leave access available indefinitely because DRF tokens do not expire automatically. This issue is fixed in version 3.18.2.

## Affected

- `django-rest-framework >= 3.12.0, < 3.18.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-114137)

Affected packages:

- `djangorestframework >= 3.12.0, < 3.18.2`

Patched in:

- `djangorestframework 3.18.2`

Source: https://osv.dev/vulnerability/GHSA-xw6w-gcfp-cf8m

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Ansible Automation Platform 2, Red Hat Discovery 2, Red Hat Satellite 6, Red Hat Update Infrastructure 4 for Cloud Providers · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Discovery 2, Red Hat Satellite 6, Red Hat Update Infrastructure 4 for Cloud Providers · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114137.json)