CVE-2026-61595: djust multi-tenant isolation bypass on WebSocket/SSE

CVE-2026-61595 · Severity: high · CVSS 7.7 · Published 2026-09-16

djust is a Django framework for building real-time, multi-tenant web applications. A security flaw in its tenant isolation logic allows authenticated users connected via WebSocket or SSE to view confidential data belonging to other customers or organizations in the same system. The application was designed to properly isolate tenant data on regular HTTP requests, but failed to enforce this protection on live connections, risking exposure of sensitive customer data and potential regulatory compliance violations.

Technologies: djust (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-61595 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-61595 being exploited in the wild.
How severe is CVE-2026-61595?
High severity, with a CVSS score of 7.7, published 16 September 2026.
Which products and versions are affected?
djust (PyPI) < 1.0.7, ECOSYSTEM:introduced=0,fixed=1.0.7.
Is there a fix for CVE-2026-61595?
Yes. djust (PyPI): upgrade to 1.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61595 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-61595?
Check whether you run djust (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • djust (PyPI): upgrade to 1.0.7 or later
    pip install "djust>=1.0.7"

Technical details

The vulnerability is a missing authorization / failing-open issue (CWE-636, CWE-862) in the djust tenant isolation layer. The root cause: tenant context was stored in `threading.local()` and set only by the HTTP-only `TenantMiddleware`, so WebSocket and SSE handlers received `None` as the current tenant. The tenant-aware `QuerySet` manager then failed open—returning unfiltered querysets regardless of `STRICT_MODE` setting—disclosing every tenant's database rows. Additionally, `threading.local` storage was shared across connections on the `sync_to_async` executor thread, compounding the cross-tenant data leak. Attack requires an authenticated user to establish a WebSocket or SSE connection. Fix (v1.0.7) moved tenant storage to `contextvars.ContextVar` (properly isolated per async task), bound tenant resolution around each mount and dispatch call, and made managers fail closed (`.none()` under default `STRICT_MODE`) when tenant cannot be determined.

Affected products

  • djust-org djust < 1.0.7

Identifiers

  • CVE-2026-61595
  • GHSA-3492-cvg7-9mr2
  • PYSEC-2026-4036

Timeline

  • 2026-06-22: disclosed: Advisory published
  • 2026-06-22: patched: Fixed in djust 1.0.7
  • 2026-09-16: advisory: GitHub Advisory Database publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.