https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T11:40:47.126635+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-225361 EUVD-2026-225361 2026-10-18T11:40:47.128876+00:00 EUVD-2026-225361 https://cve.radiocsirt.org/vuln/fkie_cve-2025-30353 fkie_cve-2025-30353 2026-10-18T11:40:47.128906+00:00

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, when a Flow with the "Webhook" trigger and the "Data of Last Operation" response body encounters a ValidationError thrown by a failed condition operation, the API response includes sensitive data. This includes environmental variables, sensitive API keys, user accountability information, and operational data. This issue poses a significant security risk, as any unintended exposure of this data could lead to potential misuse. Version 11.5.0 fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-fm3h-p9wm-h74h GHSA-fm3h-p9wm-h74h — Directus's webhook trigger flows can leak sensitive data 2026-10-18T11:40:47.128939+00:00

Affected: npm: directus

### Describe the Bug

In Directus, when a **Flow** with the "_Webhook_" trigger and the "_Data of Last Operation_" response body encounters a ValidationError thrown by a failed condition operation, the API response includes sensitive data. This includes environmental variables, sensitive API keys, user accountability information, and operational data.

This issue poses a significant security risk, as any unintended exposure of this data could lead to potential misuse.

![Image](https://github.com/user-attachments/assets/fb894347-cd10-4e79-9469-8fc1b2289794) ![Image](https://github.com/user-attachments/assets/a20337a2-005f-4cfd-ba30-fc5f579ed6c4) ![Image](https://github.com/user-attachments/assets/9b776248-4a20-46f0-92a4-3760d8e53df9)

### To Reproduce

**Steps to Reproduce:** 1. Create a Flow in Directus with: - Trigger: Webhook - Response Body: Data of Last Operation 2. Add a condition that is likely to fail. 3. Trigger the Flow with any input data that will fail the condition. 4. Observe the API response, which includes sensitive information like: - Environmental variables (`$env`) - Authorization headers - User details under `$accountability` - Previous operational data.

**Expected Behavior:** In the event of a ValidationError, the API response should only contain relevant error messages and details, avoiding the exposure of sensitive data.

**Actual Behavior:** The API response includes sensitive information such as: - Environment keys (`FLOWS_ENV_AL…