CVE-2026-86175
NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs
- State
- Published
- Severity
- 7.1 High
- Published
- Sep 5, 2026
- Updated
- Sep 24, 2026
- Reserved
- Sep 5, 2026
Description
NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to external repositories and storage buckets.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-522 Insufficiently Protected Credentials
Affected Products
| Product | Versions |
|---|---|
netboxnetbox-community |
|
References
- Researcher Advisorythird-party-advisoryexploit
- DataSourceSerializer Meta.fieldstechnical-description
- DataSourceType GraphQL fieldstechnical-description
- GitBackend sensitive_parameterstechnical-description
- GitHub Issue #12625issue-tracking
- https://github.com/netbox-community/netboxproduct
- VulnCheck Advisory: NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.