CVE-2026-61590: djust observability endpoints authentication bypass

CVE-2026-61590 · Severity: high · CVSS 7.4 · Published 2026-09-16

djust is a web application framework that includes observability endpoints for monitoring live application state and invoking handlers. The default documented setup left these sensitive endpoints network-exposed because the localhost protection was optional middleware that the documentation did not mention, and the endpoints only checked the DEBUG setting. An attacker on the network could read live application state (including session data) and invoke remote methods without authentication. The issue is fixed in version 1.0.7 by making the localhost restriction mandatory and built into the endpoints themselves.

Technologies: djust (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-61590 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-61590 being exploited in the wild.
How severe is CVE-2026-61590?
High severity, with a CVSS score of 7.4, published 16 September 2026.
Which products and versions are affected?
djust (PyPI) < 1.0.7, ECOSYSTEM:introduced=0,fixed=1.0.7.
Is there a fix for CVE-2026-61590?
Yes. djust (PyPI): upgrade to 1.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61590 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-61590?
Check whether you run djust (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • djust (PyPI): upgrade to 1.0.7 or later
    pip install "djust>=1.0.7"

Technical details

The vulnerability is a missing authentication and improper access control issue (CWE-306, CWE-668) in djust's observability endpoints. The documented default configuration did not include a required middleware for localhost-only access; instead, the views enforced only DEBUG mode, which is typically enabled in development. This allowed any network-reachable client to access the observability endpoints without authentication. An unauthenticated attacker could read live view/session state and invoke the eval_handler remote method-invocation surface. The root cause is the separation of access control logic (middleware) from the views themselves, combined with omitting the middleware from documentation. Fixed in djust 1.0.7 by enforcing the localhost restriction in-view on every observability endpoint and restricting eval_handler; ungated requests now receive a non-disclosing response. Attack vector is network; no privileges or user interaction required, but exploitation requires DEBUG=True in the documented misconfigured scenario.

Affected products

  • djust-org djust < 1.0.7

Identifiers

  • CVE-2026-61590
  • GHSA-8g2f-g3gq-5rjv
  • PYSEC-2026-4039

Timeline

  • 2026-06-22: disclosed: Published to GitHub Advisory Database
  • 2026-09-16: advisory: Updated advisory with additional details
  • 2026-06-22: patched: Fixed in djust 1.0.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.