Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-61590— djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG

Quick assessment

Affected
djust-org djust
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该漏洞描述的中文翻译： djust 为 Django 提供类似 Phoenix LiveView 的反应式服务端渲染，并具备 Rust 驱动的高性能特性。在 1.0.7 版本之前，djust 的可观测性端点会暴露实时的视图/会话状态以及一个远程方法调用接口（ ）。其中，本地主机（localhost）访问限制是一个可选安装（opt-in）的中间件，但文档中描述的默认配置并未包含该中间件；而视图本身仅强制检查 标志。在“配置错误但符合文档描述”的场景下（即 且未安装该中间件），非本地客户端也能够读取应用程序的实时

CVSS 7.4 · High EPSS 0.36% · P29

Affected Version Matrix 1

VendorProduct Version RangeStatus
djust-org djust < 1.0.7 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61590

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG
Source: CVE Program / CVE List V5
Vulnerability Description
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-invocation surface (`eval_handler`). The localhost restriction was an opt-in middleware that the documented setup omits; the views themselves enforced only `DEBUG`. In the misconfigured-but-documented scenario (DEBUG on, middleware not installed) a non-localhost client could read live application state and invoke handlers remotely. This issue is fixed in djust 1.0.7. The localhost restriction is enforced in-view on every observability endpoint (no longer dependent on a separately-installed middleware), and `eval_handler` is restricted; gated requests receive a non-disclosing response. As a workaround, ensure `DEBUG=False` in production, and do not expose the observability endpoints to untrusted networks.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
djust-org djust < 1.0.7 -

II. Public POCs for CVE-2026-61590

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61590

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-61590 (1)

Vendor Pages for CVE-2026-61590 (1)

Same Patch Batch · djust-org · 2026-09-16 · 12 CVEs total

CVE-2026-61594 9.1 CRITICAL djust has an authorization bypass on the WebSocket/SSE mount path
CVE-2026-61599 8.8 HIGH djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path
CVE-2026-61593 8.1 HIGH djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin p
CVE-2026-61591 8.1 HIGH djust: Unsigned client state snapshot is restored as trusted view state (privilege escalat
CVE-2026-61595 7.7 HIGH djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenan
CVE-2026-61592 7.4 HIGH djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id
CVE-2026-61598 7.1 HIGH Client mass-assignment of arbitrary view attributes via the default dj-model update_model
CVE-2026-61596 7.1 HIGH djust has broken object-level access control (IDOR)
CVE-2026-61588 6.5 MEDIUM djust's Django model serialization has no sensitive-field denylist: password hashes, privi
CVE-2026-61589 6.3 MEDIUM djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdoma
CVE-2026-61597 5.1 MEDIUM djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component tem

IV. Related Vulnerabilities

Same product: djust
Same vendor: djust-org
Same weakness: CWE-306