Which versions of NetBox are affected by CVE-2026-86175?

NetBox configuration management systems through version 4.7.0 expose Git passwords and AWS S3 secret access keys to any organization member with basic viewing permissions, enabling unauthorized…

Is there a public PoC exploit available for CVE-2026-86175?

Yes, a public proof-of-concept exploit is available for CVE-2026-86175. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-86175?

Within 24 hours, audit all NetBox users with view-level or higher permissions, identify and immediately rotate all Git passwords and S3 secret access keys configured as NetBox data sources, and review REST API and GraphQL access logs for evidence of credential extraction. Within 7 days, restrict NetBox API and GraphQL endpoint access through network controls (IP whitelisting, VPN requirement, or proxy authentication), enforce principle of least privilege by removing unnecessary view-level access rights, and consider rotating credentials for any external systems (Git repositories, S3 buckets) that cannot be immediately updated with new credentials. Within 30 days, monitor NetBox vendor communications and security advisories for patch availability, conduct forensic analysis of external system access logs to identify any unauthorized activities using the exposed credentials, and prepare incident response procedures to deploy patches immediately upon release.

NetBox CVE-2026-86175

Q: What is the CVSS score of CVE-2026-86175?

CVE-2026-86175 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-71974 HIGH

Insufficiently Protected Credentials (CWE-522)

2026-09-05 VulnCheck

GHSA-2fj3-v6qr-qf3j

Information Disclosure Netbox Netbox Community

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-accessible API, no special conditions, requires low-privilege authenticated account; only confidentiality is impacted (credential disclosure, no write/availability effect).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

POC Analysis Generated

Sep 05, 2026 - 15:21 vuln.today

Metadata Corrected

Sep 05, 2026 - 11:40 vuln.today

tag: Authentication Bypass removed

Analysis Generated

Sep 05, 2026 - 11:32 vuln.today

Severity Changed

Sep 05, 2026 - 11:22 NVD

MEDIUM HIGH

CVSS changed

Sep 05, 2026 - 11:22 NVD

6.5 (MEDIUM) 7.1 (HIGH)

CVE Published

Sep 05, 2026 - 11:01 cve.org

HIGH 7.1

DescriptionCVE.org

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to external repositories and storage buckets.

AnalysisAI

Credential exposure in NetBox through 4.7.0 allows any authenticated user with only view-level permissions to retrieve plaintext Git passwords and Amazon S3 secret access keys via the REST API and GraphQL interfaces. The flaw is rooted in missing field-level redaction in the API serializer and GraphQL type layer, and represents an incomplete remediation of a previously reported issue (GitHub issue #12625). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid NetBox user account - at minimum, view-level permission on the DataSource object type. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) correctly reflects low-complexity, network-accessible exploitation requiring only a valid low-privilege account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patched version has been identified at time of analysis; the upstream fix has not been tagged into a release. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, audit all NetBox users with view-level or higher permissions, identify and immediately rotate all Git passwords and S3 secret access keys configured as NetBox data sources, and review REST API and GraphQL access logs for evidence of credential extraction. …

Threat intelligence, references, and detailed analysis are available after sign-in.