THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-3492-cvg7-9mr2 (high) — djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

[GHSA] GHSA-3492-cvg7-9mr2 (high) — djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

medgithub_advisoriesPublished 2026-09-16

GHSA-3492-cvg7-9mr2 Severity: high CVE: CVE-2026-61595

djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

### Impact `djust.tenants` isolation was enforced only on the HTTP path. The current tenant was stored in `threading.local()` and set exclusively by the HTTP-only `TenantMiddleware`, so on the live (WebSocket/SSE) path `get_current_tenant()` wa

Indicators of compromise

CVE-2026-61595cve

Original source: https://github.com/advisories/GHSA-3492-cvg7-9mr2