CVE-2026-86175: NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs
NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to external repositories and storage buckets.
Affected Software
Event History
Frequently Asked Questions
Which users can retrieve the exposed credentials?
Any authenticated NetBox user granted only view permission can retrieve the plaintext Git passwords and Amazon S3 secret keys through the REST or GraphQL APIs.
What credentials and external systems are at risk?
The affected API responses can disclose data source backend credentials: passwords for Git backends and secret keys for Amazon S3 backends. An attacker could use those credentials to access the associated repositories or storage buckets.
Does exploitation require user interaction or elevated NetBox privileges?
No user interaction is required. Exploitation requires authentication and view permission, rather than administrative or modification privileges.