CVE-2026-104073
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template context. Attackers can craft a custom link template embedding request.COOKIES['sessionid'] or a user's API token into an img src URL, bypassing the clean_html sanitizer and auto-exfiltrating the victim's credentials. This enables full account takeover.
Risk Assessment
A low-privileged attacker can take over privileged user accounts by stealing their sessions and API tokens. This leads to privilege escalation and full compromise of the NetBox system.
Recommendation
Upgrade NetBox to version 4.7.0 or later. Restrict the "Can add custom links" permission to trusted users and review existing custom links for suspicious templates.
Other vulnerabilities in NetBox
See all- CVE-2026-29514High
NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the RenderTemplateMixin.get_environment_params() method. It allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary code by specifying malicious Python callables in the environment_params field.
- CVE-2023-33796Critical
A vulnerability in Netbox v3.5.1 allows unauthenticated attackers to execute queries against the GraphQL database, potentially granting access to sensitive data stored in the database.
- CVE-2026-86176Medium
NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark which objects.
- CVE-2026-86175Medium
NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to external repositories and storage buckets.
- CVE-2026-69117Medium
NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any REST API endpoint. Attackers can exploit the unrestricted queryset used by WritableNestedSerializer to perform boolean-based blind data extraction of sensitive field values and bypass object-level permissions across all application modules including dcim, ipam, tenancy, virtualization, circuits, and extras.
- CVE-2025-69848Medium
NetBox is an open-source infrastructure resource modeling and IP address management platform. A reflected cross-site scripting (XSS) vulnerability exists in versions 2.11.0 through 3.7.x in the ProtectedError handling logic, where object names are included in HTML error messages without proper escaping. This allows user-controlled content to be rendered in the web interface when a delete operation fails due to protected relationships, potentially enabling execution of arbitrary client-side code in the context of a privileged user.
- CVE-2023-37625Medium
In Netbox version 3.4.7, there is a stored XSS vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into Custom Link templates.
- CVE-2023-34565Medium
Netbox version 3.5.1 is vulnerable to Cross Site Scripting (XSS) in the 'Create Wireless LAN Groups' function.
- CVE-2023-33800Medium
Netbox v3.5.1 has a stored XSS vulnerability in the Create Regions (/dcim/regions/) function that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
- CVE-2023-33799Medium
A stored cross-site scripting (XSS) vulnerability in the Create Contacts (/tenancy/contacts/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
Original NVD description (English source)
NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template context. Attackers can craft a custom link template embedding request.COOKIES['sessionid'] or a user's API token into an img src URL, which bypasses the clean_html sanitizer and auto-exfiltrates the victim's credentials to an attacker-controlled host when a privileged user views the object, enabling full account takeover.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS