CVE-2026-61595: Multi-Tenancy Isolation Bypass on WebSocket and SSE Paths in djust
Vulnerability ID: CVE-2026-61595
CVSS Score: 7.7
Published: 2026-09-16
The multi-tenant isolation mechanism in djust prior to version 1.0.7 fails open on active WebSocket and Server-Sent Events (SSE) connections. Because the tenant context is stored in thread-local variables and initialized exclusively via HTTP middleware, asynchronous event loops executing ASGI/WebSocket code paths do not carry the resolved tenant identifier. When queries are executed without this context, the default database manager fails open, allowing authenticated users of any tenant to query and read sensitive rows across all other tenant accounts.
TL;DR
Prior to version 1.0.7, djust does not enforce multi-tenancy boundaries on WebSocket and SSE connection paths. Thread-local context storage is not preserved across ASGI async tasks, leading to an uninitialized tenant ID that defaults to returning unfiltered, global database results to authenticated users.
Technical Details
- CWE ID: CWE-636 / CWE-862
- Attack Vector: Network
- CVSS v3.1 Score: 7.7
- Impact: High (Confidentiality)
- Exploit Status: none
- KEV Status: Not Listed
Affected Systems
- djust.tenants
-
djust: < 1.0.7 (Fixed in:
1.0.7)
Mitigation Strategies
- Upgrade the djust library dependency to version 1.0.7 or newer
- Verify that DJUST_STRICT_MODE is configured to True in Django settings
- Implement Django system checks to verify context-aware query boundaries
Remediation Steps:
- Modify your project requirements file to require djust>=1.0.7
- Execute pip install -r requirements.txt or run pip install --upgrade djust>=1.0.7
- Add 'DJUST_STRICT_MODE': True to settings.py inside the DJUST_TENANTS configuration block
- Run python manage.py check on development and staging environments to identify system configuration warnings matching code S006
References
Read the full report for CVE-2026-61595 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)