{"uuid": "65bfc58f-de27-4d3e-8098-7f1f607e13e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61590", "type": "seen", "source": "https://gist.github.com/alon710/ef6456b2c611c3d15ec3538b07012ea5", "content": "# CVE-2026-61590: CVE-2026-61590: Network-Exposed Observability Endpoints and Remote Method-Invocation in djust\n\n> **CVSS Score:** 7.4\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61590\n\n## Summary\nA critical access control vulnerability in djust prior to 1.0.7 exposes diagnostic endpoints and remote method-invocation capabilities to unauthorized network actors. The vulnerability arises due to decoupling IP boundary validation into an opt-in middleware that was omitted from official configuration documentation, leaving views to rely solely on the status of Django's DEBUG flag.\n\n## TL;DR\ndjust before 1.0.7 lacks robust view-level validation, allowing remote attackers to execute arbitrary methods via eval_handler when Django DEBUG mode is active and the optional localhost middleware is missing.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-306, CWE-668\n- **Attack Vector**: Network\n- **CVSS v3.1**: 7.4\n- **EPSS Score**: Pending\n- **Impact**: Remote Method Execution\n- **Exploit Status**: Proof of Concept / Technical Advisory\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- djust\n- **djust**: < 1.0.7 (Fixed in: `1.0.7`)\n\n## Mitigation\n\n- Upgrade djust to version 1.0.7 or higher.\n- Ensure Django settings.DEBUG is set to False in all non-local deployment environments.\n- Configure firewall and reverse proxy rules to drop external requests targeting djust diagnostic URIs.\n- Manually add LocalhostOnlyMiddleware to settings.MIDDLEWARE if upgrading is delayed.\n\n**Remediation Steps:**\n1. Execute pip install --upgrade djust>=1.0.7 to pull the updated library.\n2. Open the Django configuration settings file (typically settings.py).\n3. Set DEBUG = False for production environments.\n4. If the middleware was omitted, insert 'djust.middleware.LocalhostOnlyMiddleware' (or equivalent path) into the MIDDLEWARE array.\n5. Restart WSGI/ASGI application server containers to apply configuration changes.\n\n## References\n\n- [GHSA-8g2f-g3gq-5rjv: djust Security Advisory](https://github.com/djust-org/djust/security/advisories/GHSA-8g2f-g3gq-5rjv)\n- [djust v1.0.7 Release Notes](https://github.com/djust-org/djust/releases/tag/v1.0.7)\n- [CVE-2026-61590 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-61590)\n- [djust Repository](https://github.com/djust-org/djust)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61590) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-16T20:32:38.636466Z"}