CVE-2026-39943: Directus Information Disclosure Flaw

CVE-2026-39943 Overview

CVE-2026-39943 is an Information Disclosure vulnerability in Directus, a real-time API and App dashboard for managing SQL database content. Prior to version 11.17.0, Directus stores revision records (in directus_revisions) whenever items are created or updated. Due to the revision snapshot code not consistently calling the prepareDelta sanitization pipeline, sensitive fields could be stored in plaintext within revision records. This includes user tokens, two-factor authentication secrets, external auth identifiers, auth data, stored credentials, and AI provider API keys.

Critical Impact

Sensitive authentication credentials and API keys may be exposed in plaintext within database revision records, potentially allowing unauthorized access to user accounts, external services, and AI providers.

Affected Products

• Directus versions prior to 11.17.0
• Applications using Directus directus_revisions table for audit logging
• Systems storing sensitive fields through Directus item creation/update operations

Discovery Timeline

• 2026-04-09 - CVE CVE-2026-39943 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-39943

Vulnerability Analysis

This vulnerability stems from CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The core issue lies in the inconsistent application of data sanitization within Directus's revision tracking mechanism. When items are created or updated in Directus, the system automatically generates revision snapshots stored in the directus_revisions table for audit and version control purposes.

The vulnerability enables network-based attacks where authenticated users with low privileges can potentially access highly sensitive information stored in revision records. The attack does not require user interaction and directly impacts the confidentiality of sensitive data.

Root Cause

The root cause is the failure of the revision snapshot code to consistently invoke the prepareDelta sanitization pipeline before storing data. This sanitization pipeline is designed to strip or mask sensitive fields from data before persistence. However, due to code paths that bypass this sanitization step, sensitive data including authentication tokens, 2FA secrets, external authentication identifiers, stored credentials, and third-party API keys are written to the database in plaintext format.

Attack Vector

The vulnerability is exploitable over the network by authenticated users. An attacker with valid credentials and access to the Directus API or dashboard could potentially query the directus_revisions table to retrieve historical snapshots containing sensitive information. This could expose:

• User authentication tokens enabling session hijacking
• Two-factor authentication secrets allowing 2FA bypass
• External OAuth/SAML identifiers for identity providers
• Stored database or service credentials
• AI provider API keys (OpenAI, Anthropic, etc.)

The attack requires low privileges, making it accessible to any authenticated user who can read revision data. The exposure persists in the database until those revision records are purged, creating a long-term data leakage risk.

Detection Methods for CVE-2026-39943

Indicators of Compromise

• Unusual queries against the directus_revisions table, particularly with filters targeting sensitive field names
• Unexpected API calls to revision endpoints from unauthorized or unusual sources
• Evidence of bulk data extraction from revision records
• Anomalous user activity patterns following potential credential exposure

Detection Strategies

• Implement database audit logging to track all SELECT queries against the directus_revisions table
• Monitor Directus API access logs for abnormal access patterns to revision endpoints
• Deploy SentinelOne Singularity Platform for real-time detection of suspicious database query patterns and data exfiltration attempts
• Establish baseline query patterns and alert on deviations indicating reconnaissance activity

Monitoring Recommendations

• Enable verbose logging for all database operations involving the directus_revisions table
• Configure alerting for any direct database access to revision records outside the application context
• Implement data loss prevention (DLP) rules to detect sensitive credential patterns in network traffic
• Review and audit revision data periodically for presence of sensitive field values

How to Mitigate CVE-2026-39943

Immediate Actions Required

• Upgrade Directus to version 11.17.0 or later immediately
• Audit existing directus_revisions table entries for exposed sensitive data
• Rotate all potentially exposed credentials including user tokens, 2FA secrets, and API keys
• Restrict database-level access to the directus_revisions table to essential personnel only
• Implement network segmentation to limit access to the Directus database

Patch Information

The vulnerability is fixed in Directus version 11.17.0. The patch ensures the prepareDelta sanitization pipeline is consistently applied to all revision snapshots before storage, preventing sensitive fields from being written in plaintext.

For detailed patch information, refer to:

• GitHub Release v11.17.0
• GitHub Security Advisory GHSA-mvv8-v4jj-g47j

Workarounds

• If immediate upgrade is not possible, restrict access to the directus_revisions table at the database level using access controls
• Implement a scheduled task to purge revision records containing sensitive field names
• Deploy network-level controls to limit who can access the Directus API revision endpoints
• Consider temporarily disabling revision tracking for collections containing sensitive data until the patch can be applied

# Configuration example - Restrict database access to revisions table
# PostgreSQL example: Revoke SELECT on directus_revisions from application users
REVOKE SELECT ON directus_revisions FROM directus_app_user;
GRANT SELECT ON directus_revisions TO directus_admin_user;

# Purge existing revision records (use with caution - audit first)
# DELETE FROM directus_revisions WHERE data::text LIKE '%token%' OR data::text LIKE '%secret%';