CVE-2026-61589: djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path
Impact The WebSocket handlemount and ViewRuntime.buildrequest rebuild an HttpRequest via RequestFactory().get(...) with no HTTPHOST, so request.gethost() defaulted to "testserver" on the live path. Host/subdomain/domain TenantResolvers then misresolved the tenant — None on the live path while the HTTP path resolved correctly. With STRICTMODE=False the tenant-scoped managers returned unscoped rows (cross-tenant disclosure); with the default they returned an empty queryset (broken tenancy).
Patches Fixed in djust 1.0.7. The handshake Host is extracted from the ASGI scope, validated against ALLOWEDHOSTS (the same logic as the CSWSH Origin gate, parsed with Django's splitdomainport so malformed Hosts are rejected at the boundary), and propagated — with the TLS scheme — into the reconstructed request, so live-path tenant resolution matches HTTP exactly.
Workarounds No workaround on the live path short of upgrading. Most exposed when combined with STRICTMODE=False.
Other sources
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the WebSocket handlemount and ViewRuntime.buildrequest rebuild an HttpRequest via RequestFactory().get(...) with no HTTPHOST, so request.gethost() defaulted to "testserver" on the live path. Host/subdomain/domain TenantResolvers then misresolved the tenant — None on the live path while the HTTP path resolved correctly. With STRICTMODE=False the tenant-scoped managers returned unscoped rows (cross-tenant disclosure); with the default they returned an empty queryset (broken tenancy). This is fixed in djust 1.0.7. The handshake Host is extracted from the ASGI scope, validated against ALLOWEDHOSTS (the same logic as the CSWSH Origin gate, parsed with Django's splitdomainport so malformed Hosts are rejected at the boundary), and propagated — with the TLS scheme — into the reconstructed request, so live-path tenant resolution matches HTTP exactly. There is no known workaround on the live path short of upgrading. Users are most exposed when combined with STRICTMODE=False.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/djustto a version that resolves this vulnerability.Fixed in 1.0.7 - Upgrade
Upgrade
djustto a version that resolves this vulnerability.Fixed in 1.0.7 - Configuration
Set djust's STRICT_MODE to true, since issues are most exposed when combined with STRICT_MODE=False (cross-tenant disclosure / broken tenancy on the live path).
djust STRICT_MODE = true
Event History
Frequently Asked Questions
Which deployments are exposed to cross-tenant data disclosure?
Deployments using host, subdomain, or domain TenantResolvers on the WebSocket/live path are affected before djust 1.0.7. Exposure is greatest when STRICT_MODE=False, because tenant-scoped managers can return unscoped rows when live-path tenant resolution produces None.
Does the default configuration disclose data?
With the default strict mode, the live path returns an empty queryset rather than unscoped data, causing broken tenancy rather than the described cross-tenant disclosure. Setting STRICT_MODE=False changes that behavior to unscoped row access.
What does an attacker need to exploit the issue?
The issue affects requests that reach the WebSocket live path and rely on host-based tenant resolution. The reported vector requires network access, low privileges, and no user interaction.
What can be done if upgrading is not immediately possible?
No workaround is known for the live path short of upgrading to djust 1.0.7. The fixed version validates the handshake Host against ALLOWED_HOSTS and propagates it into the reconstructed request.
How can I determine whether my application is affected?
Check whether it uses djust before 1.0.7 together with a host, subdomain, or domain TenantResolver. Compare tenant resolution on a normal HTTP request and the equivalent WebSocket/live request; affected versions resolve the live request as None while HTTP resolves the expected tenant.