{"vulnerability": "CVE-2026-6158", "sightings": [{"uuid": "c0530ee2-5989-4b28-a876-c281d3756ca7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6158", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjees36aws2w", "content": "", "creation_timestamp": "2026-04-13T07:47:01.315363Z"}, {"uuid": "cfd44aba-4745-4e67-a371-1a21e29d8525", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6158", "type": "published-proof-of-concept", "source": "Telegram/WZFVHGgaKyJ7TxaSM0Hn_zDZsEpM2ufMQ-E7g3YgMqDv7PE", "content": "", "creation_timestamp": "2026-04-13T07:18:01.000000Z"}, {"uuid": "d2a0dfaa-4eed-44b5-85cf-b5e0a67bcf2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61589", "type": "seen", "source": "https://gist.github.com/alon710/af16074dda7459d4288c488d29fd9ab0", "content": "# CVE-2026-61589: CVE-2026-61589: Host Header Propagation Failure in djust WebSocket Live Path Reconstructor\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61589\n\n## Summary\nCVE-2026-61589 is a security-bypass and information-disclosure vulnerability in the djust library prior to version 1.0.7. The library's WebSocket live path component fails to propagate the client HTTP Host header when dynamically reconstructing Django HttpRequest objects. Consequently, multi-tenant Django applications that rely on Host-based resolution may fail to isolate data correctly under certain configurations, leading to unauthorized cross-tenant data access.\n\n## TL;DR\nA security-bypass and cross-tenant data disclosure vulnerability in djust (< 1.0.7) caused by the failure to propagate HTTP Host headers over WebSocket connections, falling back to 'testserver' and bypassing multi-tenancy controls.\n\n## Technical Details\n\n- **Vulnerability Class**: Security Bypass / Improper Scoping\n- **CWE ID**: CWE-348 / CWE-639\n- **CVSS v3.1 Score**: 6.3\n- **EPSS Score**: N/A\n- **Impact**: Information Disclosure / Broken Tenancy\n- **Exploit Status**: None\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- djust library prior to version 1.0.7\n- **djust**: < 1.0.7 (Fixed in: `1.0.7`)\n\n## Mitigation\n\n- Upgrade djust to version 1.0.7\n- Set STRICT_MODE=True in tenant configurations\n\n**Remediation Steps:**\n1. Update djust to version 1.0.7 in requirements.txt or Poetry environment.\n2. Modify multi-tenancy configurations to ensure STRICT_MODE is set to True to prevent fallback queries when host resolution fails.\n3. Add logging alerts in Django to detect requests containing 'testserver' as the host in production environments.\n\n## References\n\n- [GitHub Advisory GHSA-v9rj-xjfv-xj9r](https://github.com/djust-org/djust/security/advisories/GHSA-v9rj-xjfv-xj9r)\n- [djust v1.0.7 Release Patch](https://github.com/djust-org/djust/releases/tag/v1.0.7)\n- [CVE-2026-61589 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-61589)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61589) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T08:31:33.340822Z"}, {"uuid": "79dc7272-6bba-45da-b93a-e56658e7f100", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61588", "type": "seen", "source": "https://gist.github.com/alon710/dac60322612f13505c26a5da70995cbf", "content": "# CVE-2026-61588: CVE-2026-61588: Sensitive Data Exposure via Over-Serialization in djust Framework\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61588\n\n## Summary\nA sensitive data exposure vulnerability exists in the djust framework before version 1.0.7. When serializing Django models to public view attributes, the framework fails to filter out sensitive fields such as passwords, privilege flags, and private tokens, leading to over-serialization and exposure of sensitive records to the client browser.\n\n## TL;DR\ndjust prior to 1.0.7 leaks sensitive database fields (such as user password hashes and administrator flags) to the browser when Django models are bound directly to public LiveView attributes.\n\n## Technical Details\n\n- **CWE ID**: CWE-200, CWE-359\n- **Attack Vector**: Network\n- **CVSS v3.1**: 6.5 (Medium)\n- **EPSS Score**: Not indexed\n- **Impact**: High Confidentiality Exposure\n- **Exploit Status**: None (Theoretical)\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- djust framework (Python package)\n- **djust**: < 1.0.7 (Fixed in: `1.0.7`)\n\n## Mitigation\n\n- Upgrade to djust version 1.0.7 or later to apply built-in floor denylists and customizable serialization controls.\n- Prefix internal view attributes with a leading underscore to prevent client-side serialization.\n- Explicitly serialize only required primitive fields to public attributes instead of assigning complete Django Model instances.\n\n**Remediation Steps:**\n1. Run 'pip install --upgrade djust>=1.0.7' to update the package dependency.\n2. Identify all djust LiveView classes in the codebase that assign models to self.\n3. Change public attributes (e.g., self.user) to private attributes (e.g., self._user) or define 'djust_exclude_fields' / 'djust_serializable_fields' inside your Django models.\n\n## References\n\n- [GitHub Security Advisory GHSA-pvg3-6q9j-mj3x](https://github.com/djust-org/djust/security/advisories/GHSA-pvg3-6q9j-mj3x)\n- [djust v1.0.7 Release Notes](https://github.com/djust-org/djust/releases/tag/v1.0.7)\n- [Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-61588)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61588) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T10:31:40.413866Z"}]}