Django REST Framework Token Deletion Flaw Leaves Credentials Active
A high-severity flaw in Django REST Framework causes token deletion calls to silently fail, leaving authentication credentials active despite reported success.
Key points
- CVE-2026-114137 affects Django REST Framework versions 3.12.0 through 3.18.1.
- Calling delete on TokenProxy returns success but fails to remove the database row.
- Version 3.18.2 patches the issue by correcting the primary key handling.
Django REST Framework version 3.18.2 addresses a high-severity vulnerability identified as CVE-2026-114137. The flaw impacts versions 3.12.0 up to 3.18.1. Applications using these versions may fail to revoke authentication tokens when calling delete methods on TokenProxy instances. The call reports success, but the token remains valid in the database.
How it unfolded
- TokenProxy was introduced in version 3.12.0 via PR #7341 to map admin interfaces to user IDs.
- The implementation overrides the primary key property to return the user ID instead of the token key.
- Version 3.18.2 releases a fix that resolves the identity mismatch preventing proper deletion.
Who is affected
Organizations using Django REST Framework between versions 3.12.0 and 3.18.1 are affected. Any code that relies on calling delete on a TokenProxy object to revoke credentials is vulnerable. This includes custom administrative scripts, operational automation, and application logic that manages token lifecycles. The Django admin interface is not affected because it uses a separate deletion method that fetches the concrete row before deleting.
Our take on the response
The vendor has released a patch in version 3.18.2. The fix addresses the core issue where the primary key override caused deletion queries to target the wrong column. Previous versions included workarounds in the admin interface but left programmatic deletion exposed. The silent failure makes this particularly dangerous for automated credential management systems that assume success based on return values.
Who needs to act first
Managed service providers should prioritize updating systems that use Django REST Framework for authentication. Teams usually begin by identifying all instances of the vulnerable library versions in their environments. Check whether custom scripts or applications call delete on token objects. Test the update in a non-production environment first to ensure compatibility. Back up databases before applying changes. If immediate updates are not possible, review code to avoid relying on silent deletion successes.
What to do and how to stay safe: Django REST Framework
- Update Django REST Framework to version 3.18.2 or later to apply the official patch.
- Audit application code for direct calls to TokenProxy delete methods that may have failed silently.
- Verify that existing authentication tokens are still valid and revoke any that should have been deleted.
- Monitor logs for unusual authentication activity that might indicate use of previously revoked tokens.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Django REST Framework are vulnerable?
Versions 3.12.0 up to 3.18.1 are affected by CVE-2026-114137.
Is the Django admin interface affected by this flaw?
No, the admin interface uses a separate method that correctly fetches and deletes the concrete row.
What is the recommended fix for this vulnerability?
Upgrade to Django REST Framework version 3.18.2, which includes the patch for this issue.
