DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-61590: CVE-2026-61590: Network-Exposed Observability Endpoints and Remote Method-Invocation in djust

#security #cve #cybersecurity

CVE-2026-61590: Network-Exposed Observability Endpoints and Remote Method-Invocation in djust

Vulnerability ID: CVE-2026-61590
CVSS Score: 7.4
Published: 2026-09-16

A critical access control vulnerability in djust prior to 1.0.7 exposes diagnostic endpoints and remote method-invocation capabilities to unauthorized network actors. The vulnerability arises due to decoupling IP boundary validation into an opt-in middleware that was omitted from official configuration documentation, leaving views to rely solely on the status of Django's DEBUG flag.

TL;DR

djust before 1.0.7 lacks robust view-level validation, allowing remote attackers to execute arbitrary methods via eval_handler when Django DEBUG mode is active and the optional localhost middleware is missing.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-306, CWE-668
  • Attack Vector: Network
  • CVSS v3.1: 7.4
  • EPSS Score: Pending
  • Impact: Remote Method Execution
  • Exploit Status: Proof of Concept / Technical Advisory
  • KEV Status: Not Listed

Affected Systems

  • djust
  • djust: < 1.0.7 (Fixed in: 1.0.7)

Mitigation Strategies

  • Upgrade djust to version 1.0.7 or higher.
  • Ensure Django settings.DEBUG is set to False in all non-local deployment environments.
  • Configure firewall and reverse proxy rules to drop external requests targeting djust diagnostic URIs.
  • Manually add LocalhostOnlyMiddleware to settings.MIDDLEWARE if upgrading is delayed.

Remediation Steps:

  1. Execute pip install --upgrade djust>=1.0.7 to pull the updated library.
  2. Open the Django configuration settings file (typically settings.py).
  3. Set DEBUG = False for production environments.
  4. If the middleware was omitted, insert 'djust.middleware.LocalhostOnlyMiddleware' (or equivalent path) into the MIDDLEWARE array.
  5. Restart WSGI/ASGI application server containers to apply configuration changes.

References

Read the full report for CVE-2026-61590 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)