CVE-2026-61590 djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG
Attackers can read live application state and execute remote code via exposed observability endpoints if the optional localhost middleware is omitted and DEBUG is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-61590?
CVE-2026-61590 is a high-severity missing authorization vulnerability in djust-org djust, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-invocation surface (`eval_handler`). The localhost restriction was an opt-in middleware that the documented setup omits; the views themselves enforced only `DEBUG`. In the misconfigured-but-documented scenario (DEBUG on, middleware not installed) a non-localhost client could read live application state and invoke handlers remotely. This issue is fixed in djust 1.0.7. The localhost restriction is enforced in-view on every observability endpoint (no longer dependent on a separately-installed middleware), and `eval_handler` is restricted; gated requests receive a non-disclosing response. As a workaround, ensure `DEBUG=False` in production, and do not expose the observability endpoints to untrusted networks.
Which versions are affected by CVE-2026-61590?
3 open source packages ship an affected version, including djust.
| Package | Affected | Fixed in |
|---|---|---|
djust PyPI | All versions | 1.0.7 |
djust PyPI | All versions | 1.0.7 |
djust PyPI | All versions | 1.0.7 |
How do I fix CVE-2026-61590?
Upgrade djust to 1.0.7 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-61590 being exploited?
There is no known exploitation of CVE-2026-61590 in the wild and no public exploit code.
Sources
Also known as GHSA-8g2f-g3gq-5rjv, PYSEC-2026-4039.