CVE-2026-61589: 
Python vulnerability analysis and mitigation

CVE-2026-61589 is a tenant misresolution vulnerability in djust, a Phoenix LiveView-style reactive server-side rendering library for Django. The flaw affects all djust versions prior to 1.0.7 and stems from the WebSocket handle_mount and ViewRuntime._build_request methods reconstructing an HttpRequest without propagating the client's HTTP_HOST header, causing request.get_host() to default to "testserver" on the live (WebSocket) path. This causes host/subdomain/domain TenantResolvers to misresolve the tenant, potentially exposing cross-tenant data when STRICT_MODE=False. The vulnerability was originally published on June 22, 2026, and added to the GitHub Advisory Database on September 16, 2026, with a CVSS v3.1 base score of 6.3 (Medium) (GitHub Advisory, Security Advisory).

The root cause is classified under CWE-348 (Use of Less Trusted Source) and CWE-639 (Authorization Bypass Through User-Controlled Key). When djust establishes a WebSocket connection, the handle_mount and ViewRuntime._build_request methods call RequestFactory().get(...) without supplying an HTTP_HOST value, so Django's request.get_host() falls back to the test default "testserver". Multi-tenant applications relying on host-based TenantResolvers then resolve the tenant as None on the live path, diverging from the correct resolution on the HTTP path. With STRICT_MODE=False, tenant-scoped ORM managers return unscoped querysets, enabling cross-tenant data disclosure; with the default strict mode, they return empty querysets, breaking tenancy functionality entirely (GitHub Advisory, Security Advisory).

The primary impact is a confidentiality breach in multi-tenant Django applications using djust's live (WebSocket) path with host/subdomain/domain-based tenant resolution. When STRICT_MODE=False, authenticated users of one tenant can receive unscoped database rows belonging to other tenants, constituting cross-tenant data disclosure. Even in default (strict) mode, the broken tenancy causes functional failures where live-path queries return empty results, degrading application availability for affected views. Integrity and system availability are not directly impacted by this vulnerability (GitHub Advisory).

There is no known public proof-of-concept exploit code, no evidence of in-the-wild exploitation, and no threat actor attribution associated with this vulnerability. The EPSS score is 0.0, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires low privileges (an authenticated session) and high attack complexity, as the attacker must operate within a multi-tenant deployment using host-based tenant resolution with STRICT_MODE=False to achieve cross-tenant data access (GitHub Advisory).

1. Identify target: Locate a multi-tenant Django application using djust (pip package) versions prior to 1.0.7 with host/subdomain-based TenantResolvers and STRICT_MODE=False configured.
2. Obtain low-privilege credentials: Register or obtain a valid user account on any tenant of the target application.
3. Initiate WebSocket connection: Connect to the application's djust live path (WebSocket endpoint) using a standard WebSocket client, triggering handle_mount or ViewRuntime._build_request.
4. Observe tenant misresolution: Because the reconstructed HttpRequest lacks HTTP_HOST, request.get_host() returns "testserver", causing the TenantResolver to resolve None as the tenant.
5. Access cross-tenant data: With STRICT_MODE=False, ORM queries on the live path return unscoped rows from all tenants, allowing the attacker to read data belonging to other tenants through the application's live views (GitHub Advisory, Security Advisory).

• Logs: Django application logs showing request.get_host() returning "testserver" on WebSocket/live-path requests; unexpected tenant resolution failures or None tenant values logged by TenantResolver middleware on WebSocket connections.
• Application Behavior: Live-path views returning data from multiple tenants simultaneously, or returning empty querysets for authenticated users who have valid data on the HTTP path.
• Network: Unusual WebSocket connections from authenticated users accessing live-path endpoints followed by queries returning unexpectedly broad datasets.

The vulnerability is fixed in djust version 1.0.7, released June 22, 2026. The patch extracts the Host header from the ASGI scope during the WebSocket handshake, validates it against Django's ALLOWED_HOSTS using split_domain_port (rejecting malformed hosts at the boundary), and propagates it — along with the TLS scheme — into the reconstructed HttpRequest, ensuring live-path tenant resolution matches HTTP behavior exactly. There is no known workaround for the live path short of upgrading; users should update to djust 1.0.7 immediately, with highest urgency for deployments using STRICT_MODE=False (GitHub Advisory, v1.0.7 Release).