CVE-2026-35413: 
JavaScript vulnerability analysis and mitigation

CVE-2026-35413 is a GraphQL schema SDL disclosure vulnerability in Directus, an open-source headless CMS, that allows attackers to bypass the GRAPHQL_INTROSPECTION=false security setting. When this setting is enabled, Directus correctly blocks standard introspection queries (__schema, __type), but the server_specs_graphql resolver on the /graphql/system endpoint returns an equivalent SDL (Schema Definition Language) representation of the schema without enforcing the same restriction. This exposes collection names, field names, types, and relationships to unauthenticated users (at the public permission level) or authenticated users (at their permitted permission level). All Directus versions prior to 11.16.1 are affected. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Directus Advisory).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), with an estimated secondary classification of CWE-862 (Missing Authorization). The vulnerability arises because the server_specs_graphql resolver, accessible at the /graphql/system endpoint, was not gated by the same GRAPHQL_INTROSPECTION configuration flag that restricts standard GraphQL introspection queries. An attacker can exploit this by sending a simple unauthenticated HTTP request to the /graphql/system endpoint to retrieve the full SDL schema representation, effectively circumventing the administrator-configured introspection control. No special tools, authentication, or complex payloads are required — the bypass is a straightforward omission in the authorization logic (GitHub Advisory, Directus Advisory).

The primary impact is a confidentiality breach: schema structure information — including collection names, field names, data types, and relationships — is exposed to unauthorized actors, undermining the security control that administrators believed was in place. This creates a false sense of security for administrators who configured GRAPHQL_INTROSPECTION=false specifically to hide schema details. While the vulnerability does not directly enable data modification or service disruption, the exposed schema information can significantly aid attackers in crafting targeted queries, identifying sensitive data collections, and planning further attacks against the Directus instance (GitHub Advisory).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-35413. The EPSS score is approximately 0.037% (0.018% per GitHub Advisory), indicating a low probability of exploitation in the near term. The vulnerability is trivially exploitable by any unauthenticated network attacker with access to the /graphql/system endpoint, requiring no privileges or user interaction. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was discovered and reported by bugbunny.ai (GitHub Advisory, Directus Advisory).

1. Reconnaissance: Identify internet-facing Directus instances running versions prior to 11.16.1 using tools like Shodan or Censys, or by checking the Directus version endpoint.
2. Verify introspection restriction: Confirm that the target has GRAPHQL_INTROSPECTION=false configured by attempting a standard GraphQL introspection query (e.g., {__schema{types{name}}}) against the /graphql endpoint — this should be blocked.
3. Access the SDL endpoint: Send an unauthenticated HTTP GET or POST request to the /graphql/system endpoint invoking the server_specs_graphql resolver to retrieve the SDL schema representation.
4. Extract schema information: Parse the returned SDL to enumerate collection names, field names, data types, and relationships that the administrator intended to keep hidden.
5. Leverage schema for further attacks: Use the discovered schema structure to craft targeted GraphQL queries against accessible collections, identify sensitive data fields, or plan injection or enumeration attacks against the Directus instance (GitHub Advisory).

• Network: Unusual or repeated unauthenticated HTTP requests to the /graphql/system endpoint, particularly from external or unexpected IP addresses.
• Logs: Access log entries showing requests to /graphql/system from unauthenticated sessions (no Authorization header or token), especially with high frequency or from automated tools.
• Logs: Requests to /graphql/system that return large SDL schema payloads to clients that have no legitimate business need for schema access.

Directus has released version 11.16.1 which patches this vulnerability by applying the GRAPHQL_INTROSPECTION restriction to the server_specs_graphql resolver on the /graphql/system endpoint. Administrators should upgrade to version 11.16.1 or later immediately. As a temporary workaround prior to upgrading, network-level controls (e.g., firewall rules or reverse proxy configurations) can be used to restrict access to the /graphql/system endpoint to trusted IP addresses only (GitHub Advisory, Directus Advisory).

The vulnerability was discovered and responsibly disclosed by bugbunny.ai, with the advisory published by Directus maintainer br41nslug on April 2, 2026, and added to the GitHub Advisory Database on April 4, 2026 (GitHub Advisory). A technical write-up was published by Infinit Security covering the disclosure (Infinit Security). No significant broader media coverage or notable social media controversy has been observed beyond standard CVE tracking and aggregation sites.