CVE-2026-73229 Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests
An attacker can view protected data by triggering an invalid write request, as the AdminRenderer bypasses permission checks during error rendering.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73229?
CVE-2026-73229 is a medium-severity vulnerability in encode django-rest-framework, published on 11 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRenderer.render() uses override_method() to simulate GET and directly invokes view.get() without view.check_permissions() while rendering an invalid write request, allowing a 400 Bad Request HTML response to disclose data from a GET representation that the requester is not permitted to access. This issue is fixed in version 3.17.2.
Weakness: CWE-200
Which versions are affected by CVE-2026-73229?
3 open source packages ship an affected version, including djangorestframework.
| Package | Affected | Fixed in |
|---|---|---|
djangorestframework PyPI | All versions | 3.17.2 |
djangorestframework PyPI | All versions | 3.17.2 |
djangorestframework PyPI | All versions | 3.17.2 |
How do I fix CVE-2026-73229?
Upgrade djangorestframework to 3.17.2 or later.
Is CVE-2026-73229 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73229 exists.
Sources
Also known as DEBIAN-CVE-2026-73229, ECHO-a4c9-31d4-2371, GHSA-g47c-3xmw-q6m2, MINI-2m9c-m3p8-9763, PYSEC-2026-3828, UBUNTU-CVE-2026-73229.