CVE-2026-86175
NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to external repositories and storage buckets.
| CWE | CWE-522 |
| Vendor | netbox-community |
| Product | netbox |
| Published | Sep 5, 2026 |
| Last Updated | Sep 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for netbox-community netbox
Be the first to know when new medium vulnerabilities affecting netbox-community netbox are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
netbox-community / netbox
0 ≤ 4.7.0
References
github.com: https://github.com/geo-chen/oss/blob/main/netbox.md#finding-2-netbox-data-source-backend-credentials-git-password--s3-secret-key-returned-in-plaintext-via-rest-api-and-graphql-to-users-with-only-view-permission-incomplete-fix-of-12625 github.com: https://github.com/netbox-community/netbox/blob/v4.7.0/netbox/core/api/serializers_/data.py#L26-L32 github.com: https://github.com/netbox-community/netbox/blob/v4.7.0/netbox/core/graphql/types.py#L30-L38 github.com: https://github.com/netbox-community/netbox/blob/v4.7.0/netbox/core/data_backends.py#L80 github.com: https://github.com/netbox-community/netbox/issues/12625 github.com: https://github.com/netbox-community/netbox vulncheck.com: https://www.vulncheck.com/advisories/netbox-through-4.7.0-credential-disclosure-via-rest-and-graphql-apis
Credits
🔍 George Chen