CVEvulnerability
CVE-2026-86175
7.1 HIGH
Official page ↗
- Status
- Awaiting Analysis
- Published
- 2026-09-05
- Last modified
- 2026-09-08
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 7.1 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-522
Description
NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to external repositories and storage buckets.
Related
Weakness · CWE (1)
- CWE-522 Insufficiently Protected Credentials weakness
References
- https://github.com/geo-chen/oss/blob/main/netbox.md#finding-2-netbox-data-source-backend-credentials-git-password--s3-secret-key-returned-in-plaintext-via-rest-api-and-graphql-to-users-with-only-view-permission-incomplete-fix-of-12625 github.com
- https://github.com/netbox-community/netbox github.com
- https://github.com/netbox-community/netbox/blob/v4.7.0/netbox/core/api/serializers_/data.py#L26-L32 github.com
- https://github.com/netbox-community/netbox/blob/v4.7.0/netbox/core/data_backends.py#L80 github.com
- https://github.com/netbox-community/netbox/blob/v4.7.0/netbox/core/graphql/types.py#L30-L38 github.com
- https://github.com/netbox-community/netbox/issues/12625 github.com
- https://www.vulncheck.com/advisories/netbox-through-4.7.0-credential-disclosure-via-rest-and-graphql-apis www.vulncheck.com