Skip to content
OpenAdvisories

Vendor

netbox-community

10 known vulnerabilities.

Products

netbox 5 devicetype-library 4 netbox-docker 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.6
    CVE-2026-104073

    NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links

    NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpReques…

    netbox-community netbox
  • High 8.8
    CVE-2026-54916

    NetBox Device Type Library: Module Shadowing Bypass of prior pickle fix - RCE via missing `tests/__init__.py` + SSRF via unfixed `NETBOX_DT_LIBRARY_URL` → Cloud Metadata credential theft

    NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode=importlib cause pytest prepend import mode to place the tests directory at the front of …

    netbox-community devicetype-library
  • High 8.8
    CVE-2026-29514

    NetBox 4.3.5 - 4.5.4 RCE via RenderTemplateMixin

    NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the RenderTemplateMixin.get_environment_params() method that allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary code by specify…

    netbox-community netbox