NetBox CVE-2026-104073

Requires an authenticated NetBox account holding the 'Can add custom links' permission (PR:L) - not available to anonymous or default read-only users. Exploitation additionally requires a higher-privileged victim to passively view an object of the type the malicious custom link is attached to (UI:P); the credential theft does not fire until that view occurs. Affected versions are NetBox 2.9.5 up to (but not including) 4.7.0; the vulnerability stems from the full Django HttpRequest/WSGI object being exposed to the Jinja2 custom-link context, letting request.COOKIES['sessionid'] and API tokens be read and smuggled through an <img src> URL that bypasses the clean_html sanitizer. Limiting factors: the attacker needs the delegated custom-link permission, a privileged user must trigger the payload, and upgrading to 4.7.0 (which exposes only a sanitized request subset) fully removes the sensitive attributes.

This is a credible but conditional risk, not a drop-everything emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H) tells a coherent story that matches the description: network-reachable, low attack complexity, but requiring low-level authentication (PR:L - a user holding the 'Can add custom links' permission) and passive user interaction (UI:P - a privileged victim must view an affected object before the planted template fires). Those two gating factors are the main thing that holds the score to 6.9 (Medium) despite a High confidentiality impact and full-account-takeover outcome. Confidentiality is correctly rated High (session cookies and API tokens are stolen), while the subsequent-system SC:L/SI:L reflects that the hijacked account then enables further access. No EPSS score, SSVC decision, or KEV entry is provided in the input, so exploitation probability cannot be quantified and there is no evidence of active exploitation. No public exploit was identified in the provided data. The weakest link in the risk model is the insider/low-privilege prerequisite combined with needing a higher-privileged user to trigger it - this is a privilege-escalation/credential-theft chain rather than a remote-unauthenticated RCE, so prioritize patching where custom-link permissions are delegated to semi-trusted users. Note the provided vector is CVSS 4.0 only; no CVSS 3.1 vector was supplied for cross-comparison.

A low-privileged NetBox user who has been granted the 'Can add custom links' permission creates a custom link whose Jinja2 template embeds request.COOKIES['sessionid'] (or a user's API token) inside an <img src> URL pointing to an attacker-controlled host. When an administrator or other privileged user later views an object of the targeted type, the browser auto-loads the image and silently exfiltrates the victim's live session cookie, which the attacker replays for full account takeover. No public proof-of-concept was identified in the provided data, but the vendor fix and test cases describe the exact exploitation path.