djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

CAO 7.7CVE-2026-61595 · GHSA-3492-cvg7-9mr2 · PYSEC-2026-4036 · Công bố 16/09/2026 · cập nhật 30/09/2026

Tóm tắt nhanh

CVE-2026-61595 là lỗ hổng mức CAO (CVSS 7.7) ảnh hưởng djust.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.39%, cao hơn 32.6% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.0.7 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
djust PyPI	`< 1.0.7`	`1.0.7`

Mô tả

Impact

djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local() and set exclusively by the HTTP-only TenantMiddleware, so on the live (WebSocket/SSE) path get_current_tenant() was always None during mount and every event handler — and the tenant-aware QuerySet manager failed OPEN (returned the unfiltered queryset, ignoring STRICT_MODE), disclosing every tenant's rows to whoever held the socket. threading.local was additionally shared across connections on the sync_to_async executor thread.

Patches

Fixed in djust 1.0.7. Tenant storage moved to a contextvars.ContextVar (per async task); the resolved tenant is bound around WS/SSE mount and every dispatch; both managers scope the base queryset once and fail CLOSED (.none() under the default STRICT_MODE); and system check S006 warns when STRICT_MODE=False.

Workarounds

No workaround on the live path short of upgrading.

Mô tả của NVD

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, `djust.tenants` isolation was enforced only on the HTTP path. The current tenant was stored in `threading.local()` and set exclusively by the HTTP-only `TenantMiddleware`, so on the live (WebSocket/SSE) path `get_current_tenant()` was always `None` during mount and every event handler — and the tenant-aware `QuerySet` manager failed OPEN (returned the unfiltered queryset, ignoring `STRICT_MODE`), disclosing every tenant's rows to whoever held the socket. `threading.local` was additionally shared across connections on the `sync_to_async` executor thread. This issue is fixed in djust 1.0.7. Tenant storage moved to a `contextvars.ContextVar` (per async task); the resolved tenant is bound around WS/SSE mount and every dispatch; both managers scope the base queryset once and fail CLOSED (`.none()` under the default `STRICT_MODE`); and system check S006 warns when `STRICT_MODE=False`. No known workarounds are available on the live path.