Medium severity · published Sep 5, 2026
CVE-2026-86175
NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to external repositories and storage buckets.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
netbox · netbox-community
through 4.7.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86175
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86175
github.com
https://github.com/geo-chen/oss/blob/main/netbox.md#finding-2-netbox-data-source-backend-credentials-git-password--s3-secret-key-returned-in-plaintext-via-rest-api-and-graphql-to-users-with-only-view-permission-incomplete-fix-of-12625
github.com
https://github.com/netbox-community/netbox
github.com
https://github.com/netbox-community/netbox/blob/v4.7.0/netbox/core/api/serializers_/data.py#L26-L32
github.com
https://github.com/netbox-community/netbox/blob/v4.7.0/netbox/core/data_backends.py#L80
github.com
https://github.com/netbox-community/netbox/blob/v4.7.0/netbox/core/graphql/types.py#L30-L38
github.com
https://github.com/netbox-community/netbox/issues/12625
More from netbox
8.8
CVE-2026-29514
NetBox 4.3.5 - 4.5.4 RCE via RenderTemplateMixin
7.6
CVE-2026-104073
NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links
4.3
CVE-2026-86176
NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs