CVE-2026-10716 Overview
CVE-2026-10716 is an authenticated SQL injection vulnerability in Directus, an open-source data platform. The flaw affects instances running PostgreSQL with the PostGIS extension enabled. An authenticated administrator can create a collection containing a geometry field where the fields[].type value begins with geometry but includes attacker-controlled SQL syntax appended after the geometry subtype. The injected SQL executes against the backing PostgreSQL database during the collection creation flow. The vulnerability is tracked as [CWE-89: SQL Injection] and impacts all Directus releases prior to 12.1.0.
Critical Impact
Authenticated administrators can execute arbitrary SQL against the Directus PostgreSQL backend, leading to full compromise of stored data confidentiality, integrity, and availability.
Affected Products
- Directus versions before 12.1.0
- Directus instances configured with PostgreSQL as the database backend
- Directus deployments with the PostGIS extension enabled
Discovery Timeline
- 2026-08-05 - CVE-2026-10716 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-10716
Vulnerability Analysis
Directus exposes an administrative API and interface for defining collections and fields. When an administrator creates a field of type geometry, Directus constructs SQL statements that reference the geometry subtype supplied in the fields[].type parameter. The server accepts any value that starts with the string geometry, then inserts the remainder of the value directly into the SQL sent to PostgreSQL.
Because the value is concatenated rather than parameterized, an attacker who controls the field type can append arbitrary SQL clauses after the legitimate geometry prefix. PostGIS must be enabled for the affected code path to run, since the geometry field type is only exposed when the spatial extension is present. The vulnerability requires an authenticated administrator account, which limits exposure to insider abuse, compromised administrator credentials, or chained privilege escalation.
Root Cause
The root cause is missing input validation and unsafe string concatenation in the collection creation logic. The server validates only the geometry prefix of the supplied field type and trusts the remainder as a well-formed subtype. It then embeds that value into a SQL statement without using bind parameters or an allow-list of valid PostGIS subtypes such as POINT, LINESTRING, or POLYGON.
Attack Vector
An authenticated administrator submits a crafted collection creation request to the Directus API. The malicious payload sets a field entry with a type value beginning with geometry and followed by SQL syntax such as a closing parenthesis, statement terminator, and additional SQL commands. When Directus processes the request against a PostgreSQL and PostGIS backend, the appended SQL executes with the privileges of the Directus database user. Refer to the GitHub Security Advisory GHSA-chfm-g7r3-vv42 and the Fluid Attacks Advisory: Metallica for the full technical write-up.
Detection Methods for CVE-2026-10716
Indicators of Compromise
- Collection creation requests to /collections or /fields endpoints where fields[].type starts with geometry and contains characters such as (, ), ;, --, or SQL keywords
- PostgreSQL query logs showing malformed or unexpected statements referencing geometry subtypes
- Unexpected schema changes, new database roles, or data exfiltration queries originating from the Directus database user
- Administrator account activity outside normal hours or from unfamiliar source IP addresses
Detection Strategies
- Enable PostgreSQL statement logging (log_statement = 'all') on non-production tiers and review queries generated by Directus during collection creation
- Inspect Directus application logs for API calls that create fields with unusual type values
- Add web application firewall rules that block SQL metacharacters within the type field of collection and field creation requests
Monitoring Recommendations
- Alert on any Directus field creation event where the type value contains characters beyond [a-zA-Z0-9_-]
- Track administrator session activity and correlate schema change events with the initiating user and IP
- Monitor PostgreSQL for creation of unexpected tables, functions, or extensions after Directus API activity
How to Mitigate CVE-2026-10716
Immediate Actions Required
- Upgrade Directus to version 12.1.0 or later, which contains the fix for CVE-2026-10716
- Rotate credentials for all Directus administrator accounts and the PostgreSQL role used by Directus
- Audit recent collection and field creation events for suspicious fields[].type values on PostGIS-enabled instances
- Review PostgreSQL logs for unexpected DDL or DML statements executed by the Directus database user
Patch Information
The issue is resolved in Directus Release v12.1.0. Administrators should upgrade from the Directus GitHub repository or their package manager. Details of the fix are documented in GitHub Security Advisory GHSA-chfm-g7r3-vv42.
Workarounds
- Restrict administrator role membership to a minimal set of trusted users until the patch is applied
- Disable the PostGIS extension on the Directus database if geometry field types are not required
- Place the Directus admin interface behind a VPN or IP allow-list to reduce exposure of administrator authentication endpoints
- Enforce multi-factor authentication and strong password policies on all administrator accounts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
