NetBox CVE-2026-86175

Exploitation requires a valid NetBox user account - at minimum, view-level permission on the DataSource object type. No write, admin, or special role is needed beyond basic authenticated read access. The target NetBox instance must have at least one data source configured with backend credentials (a Git password or an S3 secret key); installations with no credentials stored in data source backends are not affected. Limiting factors: unauthenticated external attackers cannot exploit this without first obtaining a NetBox account; deployments that restrict DataSource object permissions to administrators only are not affected; and deployments accessible only from internal networks or VPNs significantly reduce exposure to external threat actors.

The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) correctly reflects low-complexity, network-accessible exploitation requiring only a valid low-privilege account. No KEV listing is present, so active exploitation by threat actors is not confirmed. However, a public PoC exists in a researcher's GitHub writeup, lowering the exploitation barrier significantly for opportunistic actors. EPSS data was not provided in available intelligence. The real-world impact extends beyond the 7.1 score suggests: leaked Git credentials may expose source code repositories; leaked S3 secret keys may expose cloud storage buckets containing sensitive data, backups, or infrastructure artifacts - none of which are reflected in the NetBox-scoped CVSS metrics. The incomplete-fix history also suggests the underlying design pattern (lack of write-only field enforcement) may affect additional credential types not yet documented.

An attacker with a low-privilege NetBox view-only account - such as a contractor or junior network operator - issues a GET request to the /api/core/data-sources/ REST endpoint or submits an equivalent GraphQL query. The response includes plaintext credentials for any configured Git or S3 backends. The attacker then uses the returned S3 secret key and access key ID to authenticate directly to the AWS S3 API and enumerate or download objects from the configured bucket, or uses the Git password to clone the configured private repository. A public PoC from the reporting researcher confirms this flow.