CVE-2026-69117

NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any REST API endpoint. Attackers can exploit the unrestricted queryset used by WritableNestedSerializer to perform boolean-based blind data extraction of sensitive field values and bypass object-level permissions across all application modules including dcim, ipam, tenancy, virtualization, circuits, and extras.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/netbox-community/netbox
https://github.com/netbox-community/netbox/commit/b3489cd529ca00703a0b7fe4c45e91539add6df6
https://github.com/netbox-community/netbox/issues/21988
https://github.com/netbox-community/netbox/pull/22013
https://www.vulncheck.com/advisories/netbox-orm-injection-via-writablenestedserializer
https://github.com/netbox-community/netbox/issues/21988

Configurations

No configuration.

History

24 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) NetBox 4.5.8 contiene una vulnerabilidad de inyección ORM que permite a atacantes autenticados, incluidos aquellos con tokens de API de solo lectura, inyectar expresiones de búsqueda ORM de Django arbitrarias en referencias de objetos anidados al proporcionar claves de diccionario JSON manipuladas en solicitudes POST, PUT o PATCH a cualquier endpoint de API REST. Los atacantes pueden explotar el queryset sin restricciones utilizado por WritableNestedSerializer para realizar extracción ciega de datos basada en booleanos de valores de campos sensibles y eludir los permisos a nivel de objeto en todos los módulos de la aplicación, incluidos dcim, ipam, tenancy, virtualization, circuits y extras.

Information

Published : 2026-08-11 19:18

Updated : 2026-10-24 16:10

NVD link : CVE-2026-69117

Mitre link : CVE-2026-69117

CVE.ORG link : CVE-2026-69117

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-69117", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-69117", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T14:36:13.512861Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "NetBox Labs", "product": "NetBox", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.5.8"}], "defaultStatus": "affected"}]}], "published": "2026-08-11T19:18:42.247", "references": [{"url": "https://github.com/netbox-community/netbox", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/netbox-community/netbox/commit/b3489cd529ca00703a0b7fe4c45e91539add6df6", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/netbox-community/netbox/issues/21988", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/netbox-community/netbox/pull/22013", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/netbox-orm-injection-via-writablenestedserializer", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/netbox-community/netbox/issues/21988", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any REST API endpoint. Attackers can exploit the unrestricted queryset used by WritableNestedSerializer to perform boolean-based blind data extraction of sensitive field values and bypass object-level permissions across all application modules including dcim, ipam, tenancy, virtualization, circuits, and extras."}, {"lang": "es", "value": "NetBox 4.5.8 contiene una vulnerabilidad de inyecci\u00f3n ORM que permite a atacantes autenticados, incluidos aquellos con tokens de API de solo lectura, inyectar expresiones de b\u00fasqueda ORM de Django arbitrarias en referencias de objetos anidados al proporcionar claves de diccionario JSON manipuladas en solicitudes POST, PUT o PATCH a cualquier endpoint de API REST. Los atacantes pueden explotar el queryset sin restricciones utilizado por WritableNestedSerializer para realizar extracci\u00f3n ciega de datos basada en booleanos de valores de campos sensibles y eludir los permisos a nivel de objeto en todos los m\u00f3dulos de la aplicaci\u00f3n, incluidos dcim, ipam, tenancy, virtualization, circuits y extras."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "disclosure@vulncheck.com"}