Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-61595— djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

Quick assessment

Affected
djust-org djust
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

djust 为 Django 提供类似 Phoenix LiveView 的响应式服务端渲染，并利用 Rust 提升性能。在 1.0.7 版本之前， 的多租户隔离仅在 HTTP 请求路径上强制执行。当前租户存储在 中，且仅由专用于 HTTP 请求的 设置。因此，在实时连接（WebSocket/SSE）路径上，挂载阶段及所有事件处理器调用 时返回值始终为 。此外，具备租户感知能力的 管理器在无法确定租户时采取“开放失败”（fail OPEN）策略，即返回未过滤的查询集并忽略 设置，从而导致持有该 socket 连接的

CVSS 7.7 · High

Possible ATT&CK Techniques 2 AI

T1006 · Direct Volume Access T1527
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61595

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data
Source: CVE Program / CVE List V5
Vulnerability Description
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, `djust.tenants` isolation was enforced only on the HTTP path. The current tenant was stored in `threading.local()` and set exclusively by the HTTP-only `TenantMiddleware`, so on the live (WebSocket/SSE) path `get_current_tenant()` was always `None` during mount and every event handler — and the tenant-aware `QuerySet` manager failed OPEN (returned the unfiltered queryset, ignoring `STRICT_MODE`), disclosing every tenant's rows to whoever held the socket. `threading.local` was additionally shared across connections on the `sync_to_async` executor thread. This issue is fixed in djust 1.0.7. Tenant storage moved to a `contextvars.ContextVar` (per async task); the resolved tenant is bound around WS/SSE mount and every dispatch; both managers scope the base queryset once and fail CLOSED (`.none()` under the default `STRICT_MODE`); and system check S006 warns when `STRICT_MODE=False`. No known workarounds are available on the live path.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
未能安全地进行程序失效(Failing Open)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
djust-org djust < 1.0.7 -

II. Public POCs for CVE-2026-61595

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61595

请登录查看更多情报信息。

Vendor Pages for CVE-2026-61595 (1)

Other References for CVE-2026-61595 (1)

Same Patch Batch · djust-org · 2026-09-16 · 4 CVEs total

CVE-2026-61593 8.1 HIGH djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin p
CVE-2026-61590 7.4 HIGH djust's observability endpoints are network-exposed: the localhost gate is an opt-in middl
CVE-2026-61598 7.1 HIGH Client mass-assignment of arbitrary view attributes via the default dj-model update_model

IV. Related Vulnerabilities

Same product: djust
Same vendor: djust-org
Same weakness: CWE-636

V. Comments for CVE-2026-61595

No comments yet

Leave a comment