https://vulnerability.circl.lu/sightings/feed 2026-09-19T06:13:32.596871+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/d2a0dfaa-4eed-44b5-85cf-b5e0a67bcf2e/export 2026-09-19T06:13:32.617341+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "d2a0dfaa-4eed-44b5-85cf-b5e0a67bcf2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61589", "type": "seen", "source": "https://gist.github.com/alon710/af16074dda7459d4288c488d29fd9ab0", "content": "# CVE-2026-61589: CVE-2026-61589: Host Header Propagation Failure in djust WebSocket Live Path Reconstructor\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61589\n\n## Summary\nCVE-2026-61589 is a security-bypass and information-disclosure vulnerability in the djust library prior to version 1.0.7. The library's WebSocket live path component fails to propagate the client HTTP Host header when dynamically reconstructing Django HttpRequest objects. Consequently, multi-tenant Django applications that rely on Host-based resolution may fail to isolate data correctly under certain configurations, leading to unauthorized cross-tenant data access.\n\n## TL;DR\nA security-bypass and cross-tenant data disclosure vulnerability in djust (< 1.0.7) caused by the failure to propagate HTTP Host headers over WebSocket connections, falling back to 'testserver' and bypassing multi-tenancy controls.\n\n## Technical Details\n\n- **Vulnerability Class**: Security Bypass / Improper Scoping\n- **CWE ID**: CWE-348 / CWE-639\n- **CVSS v3.1 Score**: 6.3\n- **EPSS Score**: N/A\n- **Impact**: Information Disclosure / Broken Tenancy\n- **Exploit Status**: None\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- djust library prior to version 1.0.7\n- **djust**: < 1.0.7 (Fixed in: `1.0.7`)\n\n## Mitigation\n\n- Upgrade djust to version 1.0.7\n- Set STRICT_MODE=True in tenant configurations\n\n**Remediation Steps:**\n1. Update djust to version 1.0.7 in requirements.txt or Poetry environment.\n2. Modify multi-tenancy configurations to ensure STRICT_MODE is set to True to prevent fallback queries when host resolution fails.\n3. Add logging alerts in Django to detect requests containing 'testserver' as the host in production environments.\n\n## References\n\n- [GitHub Advisory GHSA-v9rj-xjfv-xj9r](https://github.com/djust-org/djust/security/advisories/GHSA-v9rj-xjfv-xj9r)\n- [djust v1.0.7 Release Patch](https://github.com/djust-org/djust/releases/tag/v1.0.7)\n- [CVE-2026-61589 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-61589)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61589) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T08:31:33.340822Z"} 2026-09-17T08:31:33.340822+00:00