djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path

🗓️ 01 Oct 2026 16:38:32Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 1 Views

djust WebSocket request reconstruction omits Host, causing cross-tenant disclosure.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2026-61589	17 Sep 202608:31	–	circl
CVE	CVE-2026-61589	16 Sep 202622:08	–	cve
Cvelist	CVE-2026-61589 djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path	16 Sep 202622:08	–	cvelist
EUVD	EUVD-2026-81306	16 Sep 202622:08	–	euvd
Github Security Blog	djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path	16 Sep 202622:07	–	github
NVD	CVE-2026-61589	16 Sep 202623:16	–	nvd
OSV	GHSA-V9RJ-XJFV-XJ9R djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path	16 Sep 202622:07	–	osv
OSV	PYSEC-2026-4046 djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path	1 Oct 202616:38	–	osv
Positive Technologies	PT-2026-94118	16 Sep 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-61589: Use of Less Trusted Source	16 Sep 202600:00	–	rapid7

Vulners

Node

pypi djustRange0–1.0.7

Source	Link
github	www.github.com/djust-org/djust/security/advisories/GHSA-v9rj-xjfv-xj9r
github	www.github.com/djust-org/djust
github	www.github.com/djust-org/djust/releases/tag/v1.0.7
pypi	www.pypi.org/project/djust
github	www.github.com/advisories/GHSA-v9rj-xjfv-xj9r
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-61589

01 Oct 2026 17:10Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.16.3

EPSS0.00178

SSVC