NetBox MCP Server CVE-2026-57207

Exploitation requires the server to be started with TRANSPORT=http (the default is stdio, which is unaffected) and the HTTP endpoint (default port 8000) to be network-reachable by the attacker - a condition the README's three Docker examples actively encourage by instructing HOST=0.0.0.0 with -p 8000:8000 and no authentication guidance. When those conditions hold there are no further prerequisites: no token, credential, or user interaction is needed, and FastMCP skips auth entirely because mcp.auth is never set (only CORSMiddleware is applied). Limiting factors that reduce realistic risk: stdio-transport deployments are not exposed at all; the impact is read-only (the four tools cannot modify or delete NetBox data, so no integrity or availability impact); and exposure depends on the operator choosing HTTP transport plus reachable network placement.

This is a genuine but conditional exposure rather than a universal emergency. The official CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N = 5.9) and the PoC conflict on one metric: the scored AC:H implies meaningful attacker-side difficulty, yet the GHSA advisory's confirmed PoC on v1.2.0 shows exploitation is a two-step unauthenticated curl sequence with no credentials - once the HTTP port is reachable the attack is trivial and deterministic. The most reasonable reading is that AC:H was used to credit the non-default precondition (the server must be launched with TRANSPORT=http, which is not the stdio default), not real attack complexity; see assessed_cvss_vector where I score AC:L for that reason. Impact is confidentiality-only (C:H, I:N, A:N) because all four exposed tools are read-only, but the readable data is sensitive: full NetBox inventory plus changelogs containing usernames. No EPSS score and no KEV listing were provided; CWE-306 (missing authentication) is confirmed. The vuln.today Decision label is 'this_month', consistent with a patched, config-dependent flaw that has a public PoC but no confirmed active exploitation. Net: prioritize for any deployment actually running HTTP transport, but it is not a default-configuration internet-wide crisis.

An attacker who can reach the MCP server's HTTP port (default 8000) - for example on a shared corporate network, or on the internet when deployed per the README's Docker examples using HOST=0.0.0.0 with -p 8000:8000 - sends an unauthenticated JSON-RPC 'initialize' request and receives a valid mcp-session-id. Using that session they list and invoke all four NetBox tools to enumerate the entire NetBox database (devices, IPs, VLANs, racks, circuits, VMs) and read changelogs including usernames. A confirmed working PoC against v1.2.0 is published in the GHSA advisory.