CVE-2026-104073: NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links
NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template context. Attackers can craft a custom link template embedding request.COOKIES['sessionid'] or a user's API token into an img src URL, which bypasses the cleanhtml sanitizer and auto-exfiltrates the victim's credentials to an attacker-controlled host when a privileged user views the object, enabling full account takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NetBoxto a version that resolves this vulnerability.Fixed in 4.7.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A low-privileged NetBox user who has the "Can add custom links" permission can create the malicious custom link. Exploitation then requires another user, potentially a privileged user, to view the affected object.
What credentials can be exposed if exploitation succeeds?
The malicious template can expose a viewing user's session cookie or API token to an attacker-controlled host. This can enable full account takeover of the affected user.
Are all NetBox deployments affected by default?
The issue requires a user to have permission to add custom links, so exploitation depends on that permission being assigned. A victim must also view an object containing the attacker-created custom link.
What should be done if upgrading cannot happen immediately?
Remove or restrict the "Can add custom links" permission for low-privileged users and review existing custom links for templates that reference request data, cookies, or external image URLs. Treat credentials for users who may have viewed suspicious links as potentially exposed.
How can administrators identify potential exploitation?
Review custom link templates for references such as request.COOKIES['sessionid'] or user API tokens, especially where values are embedded in an external img src URL. Also investigate attacker-controlled external hosts that may have received requests when users viewed NetBox objects.