CVE-2026-69117 NetBox Labs CVE debrief

Who should care

Defenders and administrators of NetBox 4.5.8 installations should assess exposure and prioritize remediation. This includes reviewing API access controls, monitoring for suspicious activity, and planning for updates to a fixed version of NetBox. Security teams and vulnerability management teams should also be aware of the potential impacts and take necessary actions to protect sensitive data and systems.

Why it matters

CVE-2026-69117 allows authenticated attackers to inject arbitrary Django ORM lookup expressions, potentially leading to data extraction and permission bypass

• Data extraction of sensitive field values
• Bypassing object-level permissions across application modules
• Potential for boolean-based blind data extraction

Technical summary

NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers to inject arbitrary Django ORM lookup expressions into nested object references. This can be exploited to perform boolean-based blind data extraction of sensitive field values and bypass object-level permissions across all application modules including dcim, ipam, tenancy, virtualization, circuits, and extras. The vulnerability is due to the unrestricted queryset used by WritableNestedSerializer. Attackers can supply crafted JSON dictionary keys in POST, PUT, or PATCH requests to any REST API endpoint.

Defensive priority

Authenticated attackers can inject arbitrary Django ORM lookup expressions

Recommended defensive actions

• Review and restrict API access to sensitive data and systems
• Implement additional authentication and authorization checks
• Monitor API requests for suspicious activity
• Update to a fixed version of NetBox when available
• Perform a thorough review of API usage and monitor for potential exploitation
• Ensure proper input validation and sanitization are in place
• Conduct regular security audits to identify potential vulnerabilities

Evidence notes

CVE Program record and NVD vulnerability detail page provide information on the ORM injection vulnerability in NetBox 4.5.8. The CVE record was published on 2026-08-11T19:18:42.247Z and has not been modified since then. The NVD entry is currently Awaiting Analysis. Evidence is limited to CVE Program and NVD records, with no additional information available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.