CVE-2026-69117
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any REST API endpoint. Attackers can exploit the unrestricted queryset used by WritableNestedSerializer to perform boolean-based blind data extraction of sensitive field values and bypass object-level permissions across all application modules including dcim, ipam, tenancy, virtualization, circuits, and extras.
Risk Assessment
ORM injection could allow attackers to extract sensitive data and bypass permissions, potentially compromising data confidentiality and integrity across the entire application.
Recommendation
It is recommended to immediately upgrade NetBox to a version that includes a fix for this vulnerability. Also, restrict API token permissions and monitor for unusual REST requests.
Other vulnerabilities in NetBox
See all- CVE-2026-29514High
NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the RenderTemplateMixin.get_environment_params() method. It allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary code by specifying malicious Python callables in the environment_params field.
- CVE-2023-33796Critical
A vulnerability in Netbox v3.5.1 allows unauthenticated attackers to execute queries against the GraphQL database, potentially granting access to sensitive data stored in the database.
- CVE-2026-104073High
NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template context. Attackers can craft a custom link template embedding request.COOKIES['sessionid'] or a user's API token into an img src URL, bypassing the clean_html sanitizer and auto-exfiltrating the victim's credentials. This enables full account takeover.
- CVE-2026-86176Medium
NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark which objects.
- CVE-2026-86175Medium
NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to external repositories and storage buckets.
- CVE-2025-69848Medium
NetBox is an open-source infrastructure resource modeling and IP address management platform. A reflected cross-site scripting (XSS) vulnerability exists in versions 2.11.0 through 3.7.x in the ProtectedError handling logic, where object names are included in HTML error messages without proper escaping. This allows user-controlled content to be rendered in the web interface when a delete operation fails due to protected relationships, potentially enabling execution of arbitrary client-side code in the context of a privileged user.
- CVE-2023-37625Medium
In Netbox version 3.4.7, there is a stored XSS vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into Custom Link templates.
- CVE-2023-34565Medium
Netbox version 3.5.1 is vulnerable to Cross Site Scripting (XSS) in the 'Create Wireless LAN Groups' function.
- CVE-2023-33800Medium
Netbox v3.5.1 has a stored XSS vulnerability in the Create Regions (/dcim/regions/) function that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
- CVE-2023-33799Medium
A stored cross-site scripting (XSS) vulnerability in the Create Contacts (/tenancy/contacts/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
Original NVD description (English source)
NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any REST API endpoint. Attackers can exploit the unrestricted queryset used by WritableNestedSerializer to perform boolean-based blind data extraction of sensitive field values and bypass object-level permissions across all application modules including dcim, ipam, tenancy, virtualization, circuits, and extras.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS