# CVE-2026-61589: djust host header omission in WebSocket tenant resolution

Source: https://junglewise.ai/threats/cve-2026-61589-djust-host-header-omission-in-websocket-tenant-resolution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-61589 · Severity: medium · CVSS 6.3 · Published 2026-09-16

djust is a Django framework for building real-time web applications with WebSocket support. The vulnerability allows an authenticated attacker to access tenant data that doesn't belong to them when the application uses host-based or subdomain-based tenant isolation. With default settings, this breaks tenancy entirely (users see no data); with relaxed security settings, it leaks data across tenants. The impact depends on configuration but can expose sensitive customer or organizational information.

Technologies: [djust (PyPI)](https://junglewise.ai/threats/technologies/djust). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-61589 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61589 being exploited in the wild.

**How severe is CVE-2026-61589?** Medium severity, with a CVSS score of 6.3, published 16 September 2026.

**Which products and versions are affected?** djust (PyPI) < 1.0.7, ECOSYSTEM:introduced=0,fixed=1.0.7.

**Is there a fix for CVE-2026-61589?** Yes. djust (PyPI): upgrade to 1.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61589 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-61589?** Check whether you run djust (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- djust (PyPI): upgrade to 1.0.7 or later

  ```sh
  pip install "djust>=1.0.7"
  ```


## Technical details

The vulnerability is an authorization bypass caused by missing host header propagation in WebSocket request reconstruction. The WebSocket handle_mount and ViewRuntime._build_request methods rebuild an HttpRequest using Django's RequestFactory().get(...) without setting the HTTP_HOST header. Consequently, request.get_host() defaults to "testserver" instead of the actual client host, breaking host/subdomain/domain-based TenantResolver logic. Affected code paths are WebSocket live-path operations; regular HTTP paths work correctly. Attack prerequisites include authenticated access (PR:L) and high attack complexity (AC:H), but scope is changed (S:C) as the tenant boundary is crossed. The fix (djust 1.0.7) extracts the handshake Host from the ASGI scope, validates it against ALLOWED_HOSTS, and propagates it into the reconstructed request with the correct TLS scheme. No workaround exists short of upgrading.

## Affected products

- djust djust < 1.0.7

## Identifiers

- CVE-2026-61589
- GHSA-v9rj-xjfv-xj9r
- PYSEC-2026-4046

## Timeline

- 2026-06-22: disclosed: Published to GitHub Advisory Database
- 2026-06-22: patched: djust 1.0.7 released
- 2026-09-16: other: Advisory updated

## References

- [https://github.com/djust-org/djust/security/advisories/GHSA-v9rj-xjfv-xj9r](https://github.com/djust-org/djust/security/advisories/GHSA-v9rj-xjfv-xj9r)
- [https://github.com/djust-org/djust/releases/tag/v1.0.7](https://github.com/djust-org/djust/releases/tag/v1.0.7)
- [https://api.github.com/repos/djust-org/djust/security-advisories/GHSA-v9rj-xjfv-xj9r](https://api.github.com/repos/djust-org/djust/security-advisories/GHSA-v9rj-xjfv-xj9r)

## Related threats

- [djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. From 0.9.0 until 1.0.10, 1.1.](https://junglewise.ai/threats/cve-2026-113731-djust-provides-phoenix-liveview-style-reactive-server-side)
- [djust template XSS via inherited context safety grant](https://junglewise.ai/threats/djust-template-xss-via-inherited-context-safety-grant-eaaae5cf)
- [djust multiple template-layer cross-site scripting flaws](https://junglewise.ai/threats/djust-six-template-layer-defects-emit-attacker-controlled-markup-54f3f871)
- [djust unauthenticated arbitrary module import in WebSocket/SSE](https://junglewise.ai/threats/cve-2026-61599-djust-unauthenticated-arbitrary-module-import-in-websocket-sse)
- [djust broken object-level access control (IDOR)](https://junglewise.ai/threats/cve-2026-61596-djust-broken-object-level-access-control-idor)