CVE-2024-46990: Directus SSRF Loopback IP Filter Bypass Vulnerability
Summary
CVE-2024-46990: Directus vulnerable to SSRF Loopback IP filter bypass. Affects directus across 2 version ranges.
< 10.13.3
>= 11.0.0, < 11.1.0
Fixed in 10.13.3 or 11.1.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Directus is an open-source headless CMS that provides a powerful API for managing content. It allows developers to create custom applications with ease, leveraging a flexible data model and a user-friendly interface. However, it has been found to have a vulnerability that allows attackers to bypass the default loopback IP filtering, potentially exposing sensitive internal services.
Vulnerability Detail
The vulnerability arises from the insufficient filtering of loopback IP addresses in Directus. By default, the application blocks access to localhost using the 0.0.0.0 filter. However, this can be bypassed by using other registered loopback devices, such as 127.0.0.2 to 127.127.127.127. This flaw can lead to unauthorized access to internal services, which may compromise the security of the application and its data.
How To Fix
Latest published version: 12.5.0 as of 22 Oct 2026
npm install directus@12.5.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 10.13.310.13.3npm install directus@10.13.3 -
>= 11.0.0, < 11.1.011.1.0npm install directus@11.1.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can block the bypass by manually adding the 127.0.0.0/8 CIDR range to your IP filtering configuration. This will effectively block access to any IP in the range of 127.X.X.X, preventing unauthorized access through alternative loopback addresses.
Conclusion
The SSRF Loopback IP filter bypass vulnerability in Directus poses a significant risk to applications using this CMS. It is crucial to update to the latest versions to mitigate this risk. Additionally, implementing the recommended workaround can provide temporary protection until the update is applied.
See every vulnerability recorded for directus →
FAQ
CVE-2024-46990 is a vulnerability in Directus that allows attackers to bypass loopback IP filtering, potentially exposing internal services.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to internal services, which could lead to data breaches or manipulation of sensitive information.
Versions of Directus prior to 10.13.3 and 11.1.0 for the respective packages are affected by this vulnerability.
The CVSS score of this vulnerability is 5.0, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for directus.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
