{"metadata": {"vulnerability": "CVE-2026-61590", "count": 14, "kinds": {"milestone": 5, "sighting": 1, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-07-10T17:12:17.237Z", "date_only": false, "value": "2026-07-10T17:12:17.237Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-61590", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-16T13:49:19Z", "date_only": false, "value": "2026-09-16T13:49:19Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-8G2F-G3GQ-5RJV", "record": "GHSA-8G2F-G3GQ-5RJV", "field": "published"}, {"timestamp": "2026-09-16T13:49:19Z", "date_only": false, "value": "2026-09-16T13:49:19Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-8G2F-G3GQ-5RJV", "record": "GHSA-8G2F-G3GQ-5RJV", "field": "modified"}, {"timestamp": "2026-09-16T13:50:18.892Z", "date_only": false, "value": "2026-09-16T13:50:18.892Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61590", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-16T13:50:18.892Z", "date_only": false, "value": "2026-09-16T13:50:18.892Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-61590", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-16T14:17:06.670Z", "date_only": false, "value": "2026-09-16T14:17:06.670", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61590", "record": "FKIE_CVE-2026-61590", "field": "published"}, {"timestamp": "2026-09-16T15:49:33.322Z", "date_only": false, "value": "2026-09-16T15:49:33.322402Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-61590", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-16T15:49:33.322Z", "date_only": false, "value": "2026-09-16T15:49:33.322402Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61590", "record": "FKIE_CVE-2026-61590", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-16T15:49:45.947Z", "date_only": false, "value": "2026-09-16T15:49:45.947Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-61590", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-16T15:49:45.947Z", "date_only": false, "value": "2026-09-16T15:49:45.947Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-61590", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-16T20:32:38.636Z", "date_only": false, "value": "2026-09-16T20:32:38.636466Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/ef6456b2c611c3d15ec3538b07012ea5", "record": "CVE-2026-61590", "field": "creation_timestamp", "uuid": "65bfc58f-de27-4d3e-8098-7f1f607e13e1", "content": "# CVE-2026-61590: CVE-2026-61590: Network-Exposed Observability Endpoints and Remote Method-Invocation in djust\n\n> **CVSS Score:** 7.4\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61590\n\n## Summary\nA critical access control vulnerability in djust prior to 1.0.7 exposes diagnostic endpoints and remote method-invocation capabilities to unauthorized network actors. The vulnerability arises due to decoupling IP boundary validation into an opt-in middleware that was omitted from official configuration documentation, leaving views to rely solely on the status of Django's DEBUG flag.\n\n## TL;DR\ndjust before 1.0.7 lacks robust view-level validation, allowing remote attackers to execute arbitrary methods via eval_handler when Django DEBUG mode is active and the optional localhost middleware is missing.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-306, CWE-668\n- **Attack Vector**: Network\n- **CVSS v3.1**: 7.4\n- **EPSS Score**: Pending\n- **Impact**: Remote Method Execution\n- **Exploit Status**: Proof of Concept / Technical Advisory\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- djust\n- **djust**: < 1.0.7 (Fixed in: `1.0.7`)\n\n## Mitigation\n\n- Upgrade djust to version 1.0.7 or higher.\n- Ensure Django settings.DEBUG is set to False in all non-local deployment environments.\n- Configure firewall and reverse proxy rules to drop external requests targeting djust diagnostic URIs.\n- Manually add LocalhostOnlyMiddleware to settings.MIDDLEWARE if upgrading is delayed.\n\n**Remediation Steps:**\n1. Execute pip install --upgrade djust>=1.0.7 to pull the updated library.\n2. Open the Django configuration settings file (typically settings.py).\n3. Set DEBUG = False for production environments.\n4. If the middleware was omitted, insert 'djust.middleware.LocalhostOnlyMiddleware' (or equivalent path) into the MIDDLEWARE array.\n5. Restart WSGI/ASGI application server containers to apply configuration changes.\n\n## References\n\n- [GHSA-8g2f-g3gq-5rjv: djust Security Advisory](https://github.com/djust-org/djust/security/advisories/GHSA-8g2f-g3gq-5rjv)\n- [djust v1.0.7 Release Notes](https://github.com/djust-org/djust/releases/tag/v1.0.7)\n- [CVE-2026-61590 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-61590)\n- [djust Repository](https://github.com/djust-org/djust)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61590) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/ef6456b2c611c3d15ec3538b07012ea5"}, {"timestamp": "2026-09-30T17:51:56.193Z", "date_only": false, "value": "2026-09-30T17:51:56.193", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61590", "record": "FKIE_CVE-2026-61590", "field": "lastModified"}, {"timestamp": "2026-10-01T16:38:30.820Z", "date_only": false, "value": "2026-10-01T16:38:30.820008Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2026-4039", "record": "PYSEC-2026-4039", "field": "published"}, {"timestamp": "2026-10-01T17:10:21.387Z", "date_only": false, "value": "2026-10-01T17:10:21.387461Z", "kind": "other", "label": "Updated", "source": "pysec \u00b7 PYSEC-2026-4039", "record": "PYSEC-2026-4039", "field": "modified"}]}