Netbox Mcp Server
Monthly
NetBox MCP Server 1.2.0 and earlier, when started with TRANSPORT=http, exposes its MCP HTTP endpoint with no authentication at all, so any host that can reach the listening port can open a valid MCP session and call all four NetBox read tools without supplying a token or credential. The flaw is conditional rather than universal: the default stdio transport is unaffected, and exposure requires an operator to select HTTP transport and leave the endpoint (default port 8000) network-reachable - a configuration the project README's three Docker examples actively encourage by pairing HOST=0.0.0.0 with -p 8000:8000 and no authentication guidance. The impact is read-only disclosure of the NetBox inventory and audit data (devices, IPs, VLANs, racks, circuits, VMs, changelogs including usernames), with no integrity or availability effect, and the advisory includes reproduction steps confirmed against v1.2.0 while no CISA KEV entry or other active-exploitation reporting was supplied.
NetBox MCP Server 1.2.0 and earlier, when started with TRANSPORT=http, exposes its MCP HTTP endpoint with no authentication at all, so any host that can reach the listening port can open a valid MCP session and call all four NetBox read tools without supplying a token or credential. The flaw is conditional rather than universal: the default stdio transport is unaffected, and exposure requires an operator to select HTTP transport and leave the endpoint (default port 8000) network-reachable - a configuration the project README's three Docker examples actively encourage by pairing HOST=0.0.0.0 with -p 8000:8000 and no authentication guidance. The impact is read-only disclosure of the NetBox inventory and audit data (devices, IPs, VLANs, racks, circuits, VMs, changelogs including usernames), with no integrity or availability effect, and the advisory includes reproduction steps confirmed against v1.2.0 while no CISA KEV entry or other active-exploitation reporting was supplied.