CVE-2026-86175 in NetBox
Summary
by MITRE • 09/05/2026
NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to external repositories and storage buckets.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/05/2026
The vulnerability identified in NetBox versions up to 4.7.0 represents a critical failure in data sanitization within the application's API layer, specifically affecting REST and GraphQL interfaces. This flaw allows authenticated users with minimal privileges, such as view-only access, to extract sensitive credentials stored for external backend integrations. The core technical issue stems from improper handling of serialized objects where secret fields are not explicitly excluded or masked during the response generation process. Consequently, when an API request is made to retrieve configuration details for data sources configured with Git repositories or Amazon S3 storage buckets, the serialization logic inadvertently includes plaintext passwords and secret keys in the JSON payload returned to the client. This behavior violates fundamental security principles regarding the protection of sensitive information at rest and in transit, as these credentials are exposed without any obfuscation mechanism such as asterisks or null values that are standard practice for secure API design.
From a technical perspective, this vulnerability aligns with CWE-259, which describes issues related to passwords being written to log files or other insecure locations, although in this specific context, the exposure occurs via an application programming interface rather than logs. The flaw enables unauthorized access to external systems by allowing low-privileged users to harvest credentials that should be restricted to administrative roles only. This scenario is particularly dangerous because it exploits the principle of least privilege; a user who should only have read-only visibility into network topology or device configurations can effectively escalate their impact by stealing backend authentication tokens. The attack vector involves standard API calls, requiring no complex exploitation techniques beyond valid authentication and basic knowledge of the NetBox data model structure. This simplicity makes the vulnerability highly exploitable in environments where automated scanning tools are used to probe for misconfigurations.
The operational impact of this flaw is severe, as it compromises the integrity and confidentiality of external integrations managed by NetBox. Attackers who obtain these credentials can directly interact with Git repositories or Amazon S3 buckets associated with the organization's infrastructure-as-code pipelines or data storage systems. In a Git context, this could lead to unauthorized code commits, theft of proprietary source code, or injection of malicious scripts into deployment workflows. For Amazon S3 backends, access to plaintext secret keys allows attackers to read, modify, or delete critical data stored in the associated buckets, potentially leading to significant data breaches and regulatory non-compliance. Furthermore, if these credentials are reused across other systems due to poor password hygiene within the organization, the blast radius of this vulnerability expands significantly beyond NetBox itself, facilitating lateral movement into broader enterprise infrastructure.
This incident maps directly to several tactics in the MITRE ATT&CK framework, primarily Credential Access and Discovery. The act of retrieving plaintext passwords corresponds to T1552.004, Unsecured Credentials: Private Keys, or more broadly T1556 under modifications to authentication processes if the credentials are used for further access. It also relates to T1078, Valid Accounts, as the attacker leverages legitimate but insufficiently privileged accounts to gain unauthorized information. The vulnerability highlights a gap in input validation and output encoding strategies within the application's serialization layer. To mitigate this risk, organizations running NetBox versions prior to 4.7.1 must immediately upgrade to the patched version where developers have implemented proper redaction logic for sensitive fields in API responses. Until an upgrade is performed, administrators should restrict API access strictly to trusted administrative accounts and monitor logs for unusual retrieval patterns of data source configurations. Additionally, it is critical to rotate all exposed credentials immediately after patching or upgrading, as any credential retrieved during the window of vulnerability must be considered compromised.