CVE-2026-61590

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-invocation surface (`eval_handler`). The localhost restriction was an opt-in middleware that the documented setup omits; the views themselves enforced only `DEBUG`. In the misconfigured-but-documented scenario (DEBUG on, middleware not installed) a non-localhost client could read live application state and invoke handlers remotely. This issue is fixed in djust 1.0.7. The localhost restriction is enforced in-view on every observability endpoint (no longer dependent on a separately-installed middleware), and `eval_handler` is restricted; gated requests receive a non-disclosing response. As a workaround, ensure `DEBUG=False` in production, and do not expose the observability endpoints to untrusted networks.

• CWE-306
• CWE-668

• https://github.com/djust-org/djust/releases/tag/v1.0.7
• https://github.com/djust-org/djust/security/advisories/GHSA-8g2f-g3gq-5rjv

Published

Sep 16, 2026

Last Modified

Sep 16, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61560`@zereight/mcp-gitlab` is a Model Context Protocol server fo…9.8
• CVE-2026-61568`@zereight/mcp-gitlab` is a Model Context Protocol server fo…9.6
• CVE-2026-6157A vulnerability was detected in Totolink A800R 4.1.2cu.5137_…8.8
• CVE-2026-61574authentik is an open-source identity provider. Prior to 2026…8.8
• CVE-2026-6158A flaw has been found in Totolink N300RH 6.1c.1353_B20190305…7.3
• CVE-2026-6159A vulnerability has been found in code-projects Simple ChatB…4.3
• CVE-2026-61593djust provides Phoenix LiveView-style reactive server-side r…8.1
• CVE-2026-61595djust provides Phoenix LiveView-style reactive server-side r…7.7
• CVE-2026-61598djust provides Phoenix LiveView-style reactive server-side r…7.1
• CVE-2026-6160A vulnerability was found in code-projects Simple ChatBox 1.…5.5
• CVE-2026-61605Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-61606Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…