djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG

🗓️ 01 Oct 2026 16:38:30Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 3 Views

Remote access to djust observability endpoints allows reading state and remote invocation.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2026-61590	16 Sep 202620:32	–	circl
CVE	CVE-2026-61590	16 Sep 202613:50	–	cve
Cvelist	CVE-2026-61590 djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG	16 Sep 202613:50	–	cvelist
EUVD	EUVD-2026-80744	16 Sep 202613:50	–	euvd
Github Security Blog	djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG	16 Sep 202613:49	–	github
NVD	CVE-2026-61590	16 Sep 202614:17	–	nvd
OSV	GHSA-8G2F-G3GQ-5RJV djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG	16 Sep 202613:49	–	osv
OSV	PYSEC-2026-4039 djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG	1 Oct 202616:38	–	osv
Positive Technologies	PT-2026-93746	16 Sep 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-61590: Missing Authentication for Critical Function	16 Sep 202600:00	–	rapid7

Vulners

Node

pypi djustRange0–1.0.7

Source	Link
github	www.github.com/djust-org/djust/security/advisories/GHSA-8g2f-g3gq-5rjv
github	www.github.com/djust-org/djust
github	www.github.com/djust-org/djust/releases/tag/v1.0.7
pypi	www.pypi.org/project/djust
github	www.github.com/advisories/GHSA-8g2f-g3gq-5rjv
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-61590

01 Oct 2026 17:10Current

6Medium risk

Vulners AI Score6

CVSS 3.17.4

EPSS0.00356

SSVC