Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-61589— djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path

Quick assessment

Affected
djust-org djust
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

djust 为 Django 提供类似 Phoenix LiveView 的反应式服务端渲染，并借助 Rust 实现高性能。在 1.0.7 版本之前，WebSocket 的 和 通过 重建 ，但未包含 ，导致在活动路径（live path）上， 默认返回 。这使得基于 Host/子域名/域名的 在活动路径上错误解析租户——返回 ，而 HTTP 路径能正确解析租户。当 时，租户作用域的管理器会返回未加限制的行（导致跨租户数据泄露）；在默认设置下，则返回空的查询集（导致多租户功能失效）。该问题已在 djust 1.0.

CVSS 6.3 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61589

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path
Source: CVE Program / CVE List V5
Vulnerability Description
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the WebSocket `handle_mount` and `ViewRuntime._build_request` rebuild an `HttpRequest` via `RequestFactory().get(...)` with no `HTTP_HOST`, so `request.get_host()` defaulted to `"testserver"` on the live path. Host/subdomain/domain `TenantResolver`s then misresolved the tenant — `None` on the live path while the HTTP path resolved correctly. With `STRICT_MODE=False` the tenant-scoped managers returned unscoped rows (cross-tenant disclosure); with the default they returned an empty queryset (broken tenancy). This is fixed in djust 1.0.7. The handshake Host is extracted from the ASGI scope, validated against `ALLOWED_HOSTS` (the same logic as the CSWSH Origin gate, parsed with Django's `split_domain_port` so malformed Hosts are rejected at the boundary), and propagated — with the TLS scheme — into the reconstructed request, so live-path tenant resolution matches HTTP exactly. There is no known workaround on the live path short of upgrading. Users are most exposed when combined with `STRICT_MODE=False`.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用不可信的源
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
djust-org djust < 1.0.7 -

II. Public POCs for CVE-2026-61589

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61589

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-61589 (1)

Vendor Pages for CVE-2026-61589 (1)

Same Patch Batch · djust-org · 2026-09-16 · 12 CVEs total

CVE-2026-61594 9.1 CRITICAL djust has an authorization bypass on the WebSocket/SSE mount path
CVE-2026-61599 8.8 HIGH djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path
CVE-2026-61593 8.1 HIGH djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin p
CVE-2026-61591 8.1 HIGH djust: Unsigned client state snapshot is restored as trusted view state (privilege escalat
CVE-2026-61595 7.7 HIGH djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenan
CVE-2026-61590 7.4 HIGH djust's observability endpoints are network-exposed: the localhost gate is an opt-in middl
CVE-2026-61592 7.4 HIGH djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id
CVE-2026-61598 7.1 HIGH Client mass-assignment of arbitrary view attributes via the default dj-model update_model
CVE-2026-61596 7.1 HIGH djust has broken object-level access control (IDOR)
CVE-2026-61588 6.5 MEDIUM djust's Django model serialization has no sensitive-field denylist: password hashes, privi
CVE-2026-61597 5.1 MEDIUM djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component tem

IV. Related Vulnerabilities

Same product: djust
Same vendor: djust-org
Same weakness: CWE-348

V. Comments for CVE-2026-61589

No comments yet

Leave a comment