CVE-2026-69117

Received Received - Intake

ORM Injection in NetBox 4.5.8 Allows Data Extraction

Publication date: 2026-08-11

Last updated on: 2026-08-13

Assigner: VulnCheck

Description

NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any REST API endpoint. Attackers can exploit the unrestricted queryset used by WritableNestedSerializer to perform boolean-based blind data extraction of sensitive field values and bypass object-level permissions across all application modules including dcim, ipam, tenancy, virtualization, circuits, and extras.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-13

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-69117

EUVD

EUVD-2026-56860

Affected Vendors & Products

Vendor	Product	Version / Range
netbox-community	netbox	4.5.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-69117 is an ORM injection vulnerability in NetBox 4.5.8 that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references. This is done by sending crafted JSON dictionary keys in POST, PUT, or PATCH requests to any REST API endpoint. The vulnerability stems from the unrestricted queryset used by WritableNestedSerializer, enabling attackers to extract sensitive data through boolean-based blind queries and bypass object-level permissions across all application modules.

Detection Guidance

To detect this vulnerability, monitor API requests for crafted JSON dictionary keys in POST, PUT, or PATCH requests to NetBox endpoints. Look for unusual nested object references or ORM lookup expressions in request payloads. Check logs for unauthorized data extraction attempts or permission bypass events across modules like dcim, ipam, or tenancy.

Impact Analysis

An attacker could exploit this to extract sensitive data, bypass permissions, and gain unauthorized access to restricted information across all NetBox modules such as dcim, ipam, tenancy, virtualization, circuits, and extras. Even users with limited privileges, like read-only API tokens, could perform data extraction or permission bypasses.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating compliance requirements for data protection and privacy such as GDPR and HIPAA. It enables attackers to extract sensitive information, potentially exposing personal or confidential data, which could result in regulatory penalties and loss of trust.

Mitigation Strategies

Immediately upgrade NetBox to a patched version addressing CVE-2026-69117. If upgrading is not possible, restrict API access to trusted users only and disable write operations for low-privilege accounts. Monitor API traffic for suspicious nested object references or unauthorized data access patterns.

Hi! I’m here to help you understand CVE-2026-69117. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70