CVE-2026-61590: djust Information Disclosure Vulnerability

CVE-2026-61590 Overview

djust is a Django extension that delivers Phoenix LiveView-style reactive server-side rendering backed by Rust performance. Versions prior to 1.0.7 expose observability endpoints that reveal live view and session state, along with a remote method-invocation surface named eval_handler. The documented setup omits the opt-in localhost middleware, and the views themselves only enforce Django's DEBUG flag. In the documented but misconfigured scenario, a remote client can read live application state and invoke handlers without authentication. The issue is classified as Missing Authentication for Critical Function [CWE-306].

Critical Impact
Remote unauthenticated attackers can read live session state and invoke server-side handlers on djust deployments running with DEBUG=True and no localhost middleware.

Affected Products

djust versions prior to 1.0.7
Django applications using djust observability endpoints
Deployments following the documented setup without the opt-in localhost middleware

Discovery Timeline

2026-09-16 - CVE-2026-61590 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-61590

Vulnerability Analysis

The vulnerability affects djust's observability surface, which is designed to help developers inspect live view state, session data, and handler invocations during development. Two design decisions combine to create the exposure. First, the localhost restriction is provided as a separate middleware that the documented installation instructions do not enable. Second, the observability views themselves only check whether Django's DEBUG setting is enabled, treating DEBUG=True as sufficient authorization.

When an operator follows the documentation and leaves DEBUG=True in a reachable environment, the observability endpoints accept requests from any network origin. Attackers can enumerate live view state, extract session identifiers, and call eval_handler to trigger server-side method invocations that the application logic exposes.

Root Cause

The root cause is missing authentication on a critical function [CWE-306]. Access control depends on an opt-in middleware layer that the documented setup does not install, while the views themselves enforce only a debug flag. This deviates from secure-by-default design, where sensitive introspection endpoints should bind to localhost or require authentication in-view.

Attack Vector

Exploitation requires network reachability to a djust application running with DEBUG=True and without the localhost middleware installed. The attacker sends HTTP requests directly to the observability endpoints to read live view state or to eval_handler to invoke server-side methods. No credentials or user interaction are required. Successful exploitation discloses application state and enables remote method invocation on the exposed handler surface.

Refer to the GitHub Security Advisory GHSA-8g2f-g3gq-5rjv for the vendor's technical breakdown.

Detection Methods for CVE-2026-61590

Indicators of Compromise

Unexpected HTTP requests to djust observability endpoints originating from non-localhost addresses.
Requests targeting the eval_handler route from external or untrusted network ranges.
Web server logs showing successful responses from observability views in production environments where DEBUG=True is set.

Detection Strategies

Audit deployed djust installations for the DEBUG value in Django settings and confirm the localhost middleware is installed.
Inspect application URL routing to identify exposed observability endpoints and verify their access controls.
Correlate access logs against expected internal client IP ranges to surface unauthorized remote calls.

Monitoring Recommendations

Alert on any HTTP 200 response to observability or eval_handler routes from source addresses outside the localhost loopback range.
Monitor Django production deployments for DEBUG=True misconfigurations using periodic configuration scans.
Ingest reverse proxy and application logs into a centralized analytics platform to baseline observability endpoint traffic.

How to Mitigate CVE-2026-61590

Immediate Actions Required

Upgrade djust to version 1.0.7 or later, which enforces the localhost restriction in-view on every observability endpoint.
Set DEBUG=False in all production Django settings modules.
Block network access to djust observability endpoints from untrusted networks at the reverse proxy or firewall layer.
Rotate any session tokens or credentials that may have been exposed through observability responses.

Patch Information

The fix is available in djust 1.0.7. The release enforces the localhost restriction directly in each observability view and no longer relies on a separately installed middleware. The eval_handler endpoint is additionally restricted, and gated requests receive a non-disclosing response. See the GitHub Release v1.0.7 notes for full details.

Workarounds

Ensure DEBUG=False in every production deployment of Django applications using djust.
Do not expose djust observability endpoints to untrusted networks; restrict access to loopback or internal management networks.
Install and enable the localhost restriction middleware in versions prior to 1.0.7 as an interim control.

bash

# Configuration example
# settings.py - production hardening for djust deployments
DEBUG = False
ALLOWED_HOSTS = ["app.example.com"]

# Upgrade djust to the patched release
pip install "djust>=1.0.7"