CVE-2026-35409

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.0, a Server-Side Request Forgery (SSRF) protection bypass has been identified and fixed in Directus. The IP address validation mechanism used to block requests to local and private networks could be circumvented using IPv4-Mapped IPv6 address notation. This vulnerability is fixed in 11.16.0.

• CWE-918

• https://github.com/directus/directus/security/advisories/GHSA-wv3h-5fx7-966hVendor Advisory

Published

Apr 6, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35403LORIS (Longitudinal Online Research and Imaging System) is a…5.4
• CVE-2026-35404Open edX Platform enables the authoring and delivery of onli…6.1
• CVE-2026-35405libp2p-rust is the official rust language Implementation of …7.5
• CVE-2026-35406Aardvark-dns is an authoritative dns server for A/AAAA conta…7.5
• CVE-2026-35407Saleor is an e-commerce platform. From 2.10.0 to before 3.23…6.5
• CVE-2026-35408Directus is a real-time API and App dashboard for managing S…9.3
• CVE-2026-3541Inappropriate implementation in CSS in Google Chrome prior t…8.8
• CVE-2026-35410Directus is a real-time API and App dashboard for managing S…6.1
• CVE-2026-35411Directus is a real-time API and App dashboard for managing S…4.3
• CVE-2026-35412Directus is a real-time API and App dashboard for managing S…8.1
• CVE-2026-35413Directus is a real-time API and App dashboard for managing S…5.3
• CVE-2026-35414OpenSSH before 10.3 mishandles the authorized_keys principal…8.1