CVE-2026-61589: Host Header Propagation Failure in djust WebSocket Live Path Reconstructor
Vulnerability ID: CVE-2026-61589
CVSS Score: 6.3
Published: 2026-09-16
CVE-2026-61589 is a security-bypass and information-disclosure vulnerability in the djust library prior to version 1.0.7. The library's WebSocket live path component fails to propagate the client HTTP Host header when dynamically reconstructing Django HttpRequest objects. Consequently, multi-tenant Django applications that rely on Host-based resolution may fail to isolate data correctly under certain configurations, leading to unauthorized cross-tenant data access.
TL;DR
A security-bypass and cross-tenant data disclosure vulnerability in djust (< 1.0.7) caused by the failure to propagate HTTP Host headers over WebSocket connections, falling back to 'testserver' and bypassing multi-tenancy controls.
Technical Details
- Vulnerability Class: Security Bypass / Improper Scoping
- CWE ID: CWE-348 / CWE-639
- CVSS v3.1 Score: 6.3
- EPSS Score: N/A
- Impact: Information Disclosure / Broken Tenancy
- Exploit Status: None
- CISA KEV Status: Not Listed
Affected Systems
- djust library prior to version 1.0.7
-
djust: < 1.0.7 (Fixed in:
1.0.7)
Mitigation Strategies
- Upgrade djust to version 1.0.7
- Set STRICT_MODE=True in tenant configurations
Remediation Steps:
- Update djust to version 1.0.7 in requirements.txt or Poetry environment.
- Modify multi-tenancy configurations to ensure STRICT_MODE is set to True to prevent fallback queries when host resolution fails.
- Add logging alerts in Django to detect requests containing 'testserver' as the host in production environments.
References
Read the full report for CVE-2026-61589 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)