CVE-2026-104073
NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links
- State
- Published
- Severity
- 6.9 Medium
- Published
- Oct 6, 2026
- Updated
- Oct 27, 2026
- Reserved
- Oct 1, 2026
Description
NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template context. Attackers can craft a custom link template embedding request.COOKIES['sessionid'] or a user's API token into an img src URL, which bypasses the clean_html sanitizer and auto-exfiltrates the victim's credentials to an attacker-controlled host when a privileged user views the object, enabling full account takeover.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 7.6 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N | VulnCheck |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
netboxnetbox-community |
|
References
- Release Notesrelease-notes
- GitHub Issueissue-tracking
- Pull Requestpatch
- https://www.vulncheck.com/advisories/netbox-session-hijacking-via-custom-linksthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.