Djust Vulnerability in Reactive Server-Side Rendering for Django by Djust
CVE-2026-61595

7.7HIGH

Key Information:

Vendor

Djust-org

Status
Djust
Vendor
CVE Published:
16 September 2026

What is CVE-2026-61595?

The Djust framework, which enhances Django with reactive server-side rendering capabilities, had a vulnerability that compromised tenant isolation. Prior to version 1.0.7, tenant data was inadequately secured as tenant identification was only enforced during HTTP requests. This left WebSocket and SSE paths susceptible, allowing unauthorized access to tenant data, as the system failed to recognize the current tenant. The vulnerability arose from a reliance on threading.local() for tenant storage, which was shared across connections, resulting in the exposure of unfiltered data. Version 1.0.7 addressed this issue by transitioning tenant storage to contextvars.ContextVar, ensuring proper isolation and securing tenant data across all paths. Organizations using earlier versions are strongly advised to upgrade to maintain data integrity.

Affected Version(s)

djust < 1.0.7

References

https://github.com/djust-org/djust/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/djust-org/djust/releases/tag/v1.0.7
x_refsource_MISC

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.