Is CVE-2026-35442 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35442 being exploited in the wild.

How severe is CVE-2026-35442?

High severity, with a CVSS score of 8.1, published 6 April 2026.

Which products and versions are affected?

directus (npm) < 11.17.0, SEMVER:introduced=0,fixed=11.17.0.

Is there a fix for CVE-2026-35442?

Yes. directus (npm): upgrade to 11.17.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35442 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-35442?

Check whether you run directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35442: Directus sensitive information disclosure via aggregate queries

Q: Which products and versions are affected?

directus (npm) < 11.17.0, SEMVER:introduced=0,fixed=11.17.0.

Q: Is there a fix for CVE-2026-35442?

Yes. directus (npm): upgrade to 11.17.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-35442 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-35442?

Check whether you run directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35442 · Severity: high · CVSS 8.1 · Published 2026-04-06

Directus is a headless CMS and backend platform that protects sensitive fields like API tokens and two-factor authentication secrets by masking them on read. However, aggregate query functions (min/max) bypass this protection and return raw values. An authenticated attacker with basic read access can extract all API tokens and 2FA seeds, enabling account takeover of any user including administrators without requiring their credentials.

Technologies: directus (npm). Vendors: npm.

Quick answers

Is CVE-2026-35442 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35442 being exploited in the wild.
How severe is CVE-2026-35442?: High severity, with a CVSS score of 8.1, published 6 April 2026.
Which products and versions are affected?: directus (npm) < 11.17.0, SEMVER:introduced=0,fixed=11.17.0.
Is there a fix for CVE-2026-35442?: Yes. directus (npm): upgrade to 11.17.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35442 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-35442?: Check whether you run directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

directus (npm): upgrade to 11.17.0 or later
```
npm install directus@11.17.0
```

Technical details

This vulnerability affects Directus field masking logic for concealed field types. Fields marked with the conceal special type are protected by payload processing that replaces real values with masked placeholders during standard read operations. However, aggregate query results use a different nested structure—operations are keyed under their function name (min/max) rather than appearing as flat field keys. The masking logic does not account for this nested format and silently skips concealed fields in aggregate responses, returning raw database values including static API tokens and TOTP seeds from directus_users. Exploitation requires authentication and read access to the affected collection. An attacker can use groupBy combined with aggregate functions to harvest all concealed field values. The vulnerability was patched in version 11.17.0.

Affected products

Directus Directus <11.17.0

Identifiers

CVE-2026-35442
GHSA-38hg-ww64-rrwc

Timeline

2026-04-04: disclosed: Vulnerability published by Directus security team
2026-04-04: patched: Fixed in version 11.17.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.