NetBox EUVD-2026-56860

Exploitation requires a valid NetBox API token at any privilege level, including read-only tokens issued for monitoring or integration purposes - unauthenticated access is not sufficient (PR:L confirmed by CVSS 4.0 vector). The attack targets REST API write endpoints (POST, PUT, or PATCH) only; read-only GET requests are not affected. No special server-side configuration is required beyond a default NetBox installation with the REST API enabled, which is the standard deployment mode. Object-level permissions (if configured) are bypassed by this vulnerability. Exploitation is constrained to confidentiality impact only - the attacker cannot modify or delete data through this vector. The boolean-based blind extraction method requires many sequential requests per extracted field, which may be detectable via access log volume anomalies.

The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) accurately captures the realistic threat: the attack is network-accessible, low-complexity, requires no user interaction, and demands only a valid API token at any privilege level - a very low bar in environments where read-only tokens are distributed broadly. The high confidentiality impact reflects the ability to exfiltrate sensitive data across all modules. EPSS data was not provided in the available intelligence, so probability scoring cannot be incorporated. The absence from CISA KEV indicates no confirmed mass exploitation at time of analysis; this is not contradicted by other signals and suggests opportunistic rather than widespread abuse so far. The boolean-based blind technique requires many iterative requests to exfiltrate meaningful data, which slows exploitation but does not prevent a determined attacker with network access and a token. The breadth of affected modules (all six core application areas) means the potential data exposure is comprehensive for any NetBox instance running ≤4.5.8.

An attacker holding a read-only NetBox API token sends a PATCH request to an endpoint such as /api/dcim/devices/ where nested object fields contain JSON keys like {'field__secret_value__startswith': 'a'} rather than a plain primary key. By observing whether the API returns a validation success or error response, the attacker determines if the condition is true or false, then iterates through characters to reconstruct sensitive field values - extracting IPAM addresses, credentials, or restricted tenant data that the token's permissions would not normally expose. No public POC has been identified at time of analysis, but the technique is a well-understood boolean-based blind injection pattern.