CVE-2026-104073

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: VulnCheck

Description

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template context. Attackers can craft a custom link template embedding request.COOKIES['sessionid'] or a user's API token into an img src URL, which bypasses the clean_html sanitizer and auto-exfiltrates the victim's credentials to an attacker-controlled host when a privileged user views the object, enabling full account takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104073

EUVD

EUVD-2026-93660

Affected Vendors & Products

Vendor	Product	Version / Range
netbox-community	netbox	2.9.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-668	The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

Attack-Flow Graph

Executive Summary

NetBox versions 2.9.5 before 4.7.0 have a server-side template injection flaw. A low-privileged user with the 'Can add custom links' permission can exploit this to steal session cookies and API tokens of other users by injecting malicious Jinja2 templates. The attack involves embedding request.COOKIES or API tokens into an img src URL, which auto-exfiltrates credentials when a privileged user views the object, leading to account takeover.

Detection Guidance

This vulnerability requires checking for unauthorized custom link templates in NetBox that may exfiltrate session cookies or API tokens. Inspect templates for suspicious Jinja2 expressions like request.COOKIES['sessionid'] or hardcoded URLs pointing to external domains. Review user permissions to ensure only trusted users have the 'Can add custom links' permission.

Impact Analysis

If you are a NetBox user with privileged access, an attacker could steal your session cookies or API tokens. This allows them to impersonate you, access sensitive data, or perform unauthorized actions in your account. Even low-privileged users with specific permissions can exploit this to target higher-privileged users.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using affected NetBox versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Upgrade NetBox to version 4.7.0 or later to address the server-side template injection vulnerability. Ensure the 'Can add custom links' permission is restricted to only necessary users.

Hi! I’m here to help you understand CVE-2026-104073. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70