MEDIUM 6.3 GitHub
CVE-2026-61589
djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path
### Impact
The WebSocket `handle_mount` and `ViewRuntime._build_request` rebuild an `HttpRequest` via `RequestFactory().get(...)` with no `HTTP_HOST`, so `request.get_host()` defaulted to `"testserver"` on the live path. Host/subdomain/domain `TenantResolver`s then misresolved the tenant — `None` on the live path while the HTTP path resolved correctly. With `STRICT_MODE=False` the tenant-scoped managers returned unscoped rows (**cross-tenant disclosure**); with the default they returned an empty
Affected Products
- pip/djust < 1.0.7
References
- https://github.com/advisories/GHSA-v9rj-xjfv-xj9r
- https://github.com/djust-org/djust/security/advisories/GHSA-v9rj-xjfv-xj9r
- https://github.com/djust-org/djust/releases/tag/v1.0.7
- https://github.com/advisories/GHSA-v9rj-xjfv-xj9r
This medium severity vulnerability with a CVSS score of 6.3 was published on 2026-09-16 via GitHub. Affected: pip/djust < 1.0.7.
vulnfeed aggregates 14597 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.