요약
- CVE-2026-39943은(는) directus (monospace), directus에 영향을 주는 보통 (CVSS 6.5) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.17%, 전체 취약점의 6.3%보다 높음.
- 조치: 11.17.0 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| directus | < 11.17.0
| 11.17.0
|
| directus npm | < 11.17.0
| 11.17.0
|
Description
Summary
Directus stores revision records (in directus_revisions) whenever items are created or updated. Due to the revision snapshot code not consistently calling the prepareDelta sanitization pipeline, sensitive fields (including user tokens, two-factor authentication secrets, external auth identifiers, auth data, stored credentials, and AI provider API keys) could be stored in plaintext within revision records.
Impact
Any user or service account with read access to directus_revisions (or flow logs) could retrieve values for fields that are supposed to be concealed or encrypted at rest, including:
token, tfa_secret, external_identifier, auth_data, credentialsai_openai_api_key, ai_anthropic_api_key, ai_google_api_key, ai_openai_compatible_api_key
This could lead to account takeover (via stolen tokens or 2FA secrets) or unauthorized use of third-party API keys stored against users.
Affected code paths
- Item create/update revisions The data (snapshot) field written to directus_revisions was not processed through prepareDelta, so concealed/encrypted fields were stored without redaction. Relational fields were also included, which should have been excluded.
- Authentication service When a user was auto-suspended after repeated failed login attempts, the revision record was created with the raw user object (including all sensitive fields) rather than the sanitized delta.
NVD description
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus stores revision records (in directus_revisions) whenever items are created or updated. Due to the revision snapshot code not consistently calling the prepareDelta sanitization pipeline, sensitive fields (including user tokens, two-factor authentication secrets, external auth identifiers, auth data, stored credentials, and AI provider API keys) could be stored in plaintext within revision records. This vulnerability is fixed in 11.17.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free