CVE-2026-29514: NetBox 4.3.5 - 4.5.4 RCE via RenderTemplateMixin
NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the RenderTemplateMixin.getenvironmentparams() method that allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary code by specifying malicious Python callables in the environmentparams field. Attackers can bypass Jinja2 SandboxedEnvironment protections by setting the finalize parameter to any importable Python callable such as subprocess.getoutput, which is invoked on every rendered expression outside the sandbox's call interception mechanism, achieving remote code execution as the NetBox service user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
netboxto a version that resolves this vulnerability.Fixed in 4.3.5 - 4.5.4 - Configuration
Ensure environment_params used for Jinja2 SandboxedEnvironment rendering cannot be influenced by authenticated users with exporttemplate/configtemplate permissions to set finalize to arbitrary importable Python callables; validate/whitelist allowed finalize callable behavior or reject any values that enable callable injection.
NetBox RenderTemplateMixin (template environment_params) environment_params = Do not allow user-supplied values that specify importable Python callables (e.g., attacker-controlled finalize parameter via environment_params)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29514?
CVE-2026-29514 is classified as a critical vulnerability due to its potential for remote code execution by authenticated users.
How do I fix CVE-2026-29514?
To mitigate CVE-2026-29514, it is recommended to upgrade NetBox to a version later than 4.5.4.
Who is affected by CVE-2026-29514?
CVE-2026-29514 affects users of NetBox versions 4.3.5 to 4.5.4 who have exporttemplate or configtemplate permissions.
What type of vulnerability is CVE-2026-29514?
CVE-2026-29514 is a remote code execution vulnerability that allows execution of arbitrary code.
What components of NetBox are involved in CVE-2026-29514?
CVE-2026-29514 involves the RenderTemplateMixin.get_environment_params() method in NetBox.