CVE-2026-61589

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the WebSocket `handle_mount` and `ViewRuntime._build_request` rebuild an `HttpRequest` via `RequestFactory().get(...)` with no `HTTP_HOST`, so `request.get_host()` defaulted to `"testserver"` on the live path. Host/subdomain/domain `TenantResolver`s then misresolved the tenant — `None` on the live path while the HTTP path resolved correctly. With `STRICT_MODE=False` the tenant-scoped managers returned unscoped rows (cross-tenant disclosure); with the default they returned an empty queryset (broken tenancy). This is fixed in djust 1.0.7. The handshake Host is extracted from the ASGI scope, validated against `ALLOWED_HOSTS` (the same logic as the CSWSH Origin gate, parsed with Django's `split_domain_port` so malformed Hosts are rejected at the boundary), and propagated — with the TLS scheme — into the reconstructed request, so live-path tenant resolution matches HTTP exactly. There is no known workaround on the live path short of upgrading. Users are most exposed when combined with `STRICT_MODE=False`.

• CWE-348
• CWE-639

• https://github.com/djust-org/djust/releases/tag/v1.0.7
• https://github.com/djust-org/djust/security/advisories/GHSA-v9rj-xjfv-xj9r

Published

Sep 16, 2026

Last Modified

Sep 17, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61560`@zereight/mcp-gitlab` is a Model Context Protocol server fo…9.8
• CVE-2026-61568`@zereight/mcp-gitlab` is a Model Context Protocol server fo…9.6
• CVE-2026-6157A vulnerability was detected in Totolink A800R 4.1.2cu.5137_…8.8
• CVE-2026-61574authentik is an open-source identity provider. Prior to 2026…8.8
• CVE-2026-6158A flaw has been found in Totolink N300RH 6.1c.1353_B20190305…7.3
• CVE-2026-61588djust provides Phoenix LiveView-style reactive server-side r…6.5
• CVE-2026-6159A vulnerability has been found in code-projects Simple ChatB…4.3
• CVE-2026-61590djust provides Phoenix LiveView-style reactive server-side r…7.4
• CVE-2026-61591djust provides Phoenix LiveView-style reactive server-side r…8.1
• CVE-2026-61592djust provides Phoenix LiveView-style reactive server-side r…7.4
• CVE-2026-61593djust provides Phoenix LiveView-style reactive server-side r…8.1
• CVE-2026-61594djust provides Phoenix LiveView-style reactive server-side r…9.1