Directus inserts access token from query string into logs
Description
Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed in system logs which may be persisted. The access token in req.query is not redacted when the LOG_STYLE is set to raw. If these logs are not properly sanitized or protected, an attacker with access to it can potentially gain administrative control, leading to unauthorized data access and manipulation. This impacts systems where the LOG_STYLE is set to raw. The access_token in the query could potentially be a long-lived static token. Users with impacted systems should rotate their static tokens if they were provided using query string. This vulnerability has been patched in release version 10.13.2 and subsequent releases as well. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@directus/apinpm | < 21.0.0 | 21.0.0 |
Affected products
1Patches
12 files changed · +6 −1
api/src/logger/index.ts+1 −1 modified@@ -100,7 +100,7 @@ export const createExpressLogger = () => { if (env['LOG_STYLE'] === 'raw') { httpLoggerOptions.redact = { - paths: ['req.headers.authorization', 'req.headers.cookie', 'res.headers'], + paths: ['req.headers.authorization', 'req.headers.cookie', 'res.headers', 'req.query.access_token'], censor: (value, pathParts) => { const path = pathParts.join('.');
.changeset/chilly-adults-jog.md+5 −0 added@@ -0,0 +1,5 @@ +--- +'@directus/api': patch +--- + +Redacted `access_token` in the query string when `LOG_STYLE=raw`
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- github.com/advisories/GHSA-vw58-ph65-6rxpghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-47822ghsaADVISORY
- github.com/directus/directus/commit/2e893f9c576d5a02506272fe2c0bcc12e6c58768ghsax_refsource_MISCWEB
- github.com/directus/directus/security/advisories/GHSA-vw58-ph65-6rxpghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.