Is CVE-2026-39943 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39943 being exploited in the wild.

How severe is CVE-2026-39943?

Low severity, with a CVSS score of 3.1, published 4 April 2026.

Which products and versions are affected?

directus (npm) SEMVER:introduced=0,fixed=11.17.0.

Is there a fix for CVE-2026-39943?

Yes. directus (npm): upgrade to 11.17.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39943 attacked?

It is attacked over the network.

Am I affected by CVE-2026-39943?

Check whether you run directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39943: Directus sensitive fields exposed in revision history

CVE-2026-39943 · Severity: low · CVSS 3.1 · Published 2026-04-04

Directus, a popular headless CMS and backend API platform, stores revision history of all item changes in a database table. Due to incomplete sanitization of sensitive data during revision recording, credentials such as authentication tokens, two-factor secrets, API keys, and stored passwords could be saved in plain text within revision records. Any user with access to the revision history table could retrieve these secrets, potentially leading to account takeover or unauthorized API access.

Technologies: directus (npm). Vendors: npm.

Quick answers

Is CVE-2026-39943 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39943 being exploited in the wild.
How severe is CVE-2026-39943?: Low severity, with a CVSS score of 3.1, published 4 April 2026.
Which products and versions are affected?: directus (npm) SEMVER:introduced=0,fixed=11.17.0.
Is there a fix for CVE-2026-39943?: Yes. directus (npm): upgrade to 11.17.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39943 attacked?: It is attacked over the network.
Am I affected by CVE-2026-39943?: Check whether you run directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

directus (npm): upgrade to 11.17.0 or later
```
npm install directus@11.17.0
```

Technical details

The vulnerability is a cleartext storage of sensitive information flaw (CWE-312, CWE-200) in Directus's revision snapshot mechanism. When items are created or updated, revision records are written to the directus_revisions table without consistently passing the data through the prepareDelta sanitization pipeline. This allows sensitive fields (token, tfa_secret, external_identifier, auth_data, credentials, and AI API keys) to be stored unencrypted. The vulnerability is present in two code paths: (1) item create/update revisions skip prepareDelta sanitization, and (2) authentication service revisions during auto-suspension record the raw user object. The attack requires network access and low-privilege database read access to directus_revisions or flow logs. A fix is available in version 11.17.0 and later.

Affected products

Directus Directus <11.17.0

Identifiers

CVE-2026-39943
GHSA-mvv8-v4jj-g47j

Timeline

2026-04-04: disclosed
2026-04-04: patched: version 11.17.0 released

References

https://github.com/directus/directus/security/advisories/GHSA-mvv8-v4jj-g47j

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.