high · 7.4CVE-2026-61590Sep 16, 2026

CVE-2026-61590: djust Unauthenticated Observability Endpoint Exposure

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

djust's built-in debug endpoints, including a remote method invocation handler, were reachable from any network client when DEBUG was on and the optional localhost middleware was not installed…

Packagedjust
Ecosystempip
Affected< 1.0.7
Fixed in1.0.7
CVE-2026-61590: djust Unauthenticated Observability Endpoint Exposure

The problem

djust ships seven HTTP endpoints under /_djust/observability/ for live framework introspection. These include live view state, session data, an exception log, and eval_handler, a remote method-invocation surface.

The localhost restriction was implemented as a separate, opt-in middleware. The documented setup did not install it. The views themselves checked only settings.DEBUG, so any non-localhost client on a DEBUG-enabled deployment could read live application state or invoke handlers remotely (CWE-306, CWE-668).

Proof of concept

A working proof-of-concept for CVE-2026-61590 in djust, with the exact payload below.

http
# Read live server-side view state for a known session key
GET /_djust/observability/view_state?session_key=abc123 HTTP/1.1
Host: target.example.com

# Invoke a handler remotely via eval_handler
POST /_djust/observability/eval_handler HTTP/1.1
Host: target.example.com
Content-Type: application/json

{"handler": "increment", "kwargs": {}}

Before 1.0.7, every observability view contained only a if not settings.DEBUG: return HttpResponseForbidden() guard. The localhost gate existed only in djust.middleware.ObservabilityLocalhostMiddleware, which the documented quickstart omitted. A remote attacker on a DEBUG-enabled app could call any of the seven endpoints directly.

The eval_handler endpoint accepted a JSON body naming a handler method and kwargs, then dispatched it server-side, giving an unauthenticated caller arbitrary event-handler invocation against any mounted LiveView. The patch moved the REMOTE_ADDR == 127.0.0.1 check into each view function, making it unconditional and independent of middleware ordering.

Public PoC not yet available; payload derived from the advisory description and documented endpoint structure.

The fix

Upgrade to djust 1.0.7. The localhost check is now enforced inside every observability view, regardless of middleware. As an interim workaround, set DEBUG=False in production and block /_djust/observability/ at the network or web-server level for untrusted clients.

Reporter not attributed.

References: [1][2][3]

Related research