Is CVE-2026-29514 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-29514 being exploited in the wild.

How severe is CVE-2026-29514?

High severity, with a CVSS score of 8.8, published 4 May 2026.

Which products and versions are affected?

NetBox Labs NetBox 4.3.5 - 4.5.4.

Is there a fix for CVE-2026-29514?

A patch was published on 2026-05-14: Fix committed to NetBox repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-29514 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-29514?

Check whether you run NetBox Labs NetBox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-29514: NetBox remote code execution in RenderTemplateMixin via Jinja2 sandbox bypass

CVE-2026-29514 · Severity: high · CVSS 8.8 · Published 2026-05-04

NetBox, a popular open-source platform for managing network infrastructure and IP addresses, contains a security flaw that allows certain authenticated users to execute unauthorized commands on the server. Users with permissions to manage export or configuration templates can bypass security restrictions by injecting malicious Python code into template settings. This could allow an attacker to take full control of the NetBox service, potentially leading to the theft of sensitive network data or disruption of operations.

Technologies: NetBox Labs NetBox. Vendors: NetBox Labs.

Quick answers

Is CVE-2026-29514 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-29514 being exploited in the wild.
How severe is CVE-2026-29514?: High severity, with a CVSS score of 8.8, published 4 May 2026.
Which products and versions are affected?: NetBox Labs NetBox 4.3.5 - 4.5.4.
Is there a fix for CVE-2026-29514?: A patch was published on 2026-05-14: Fix committed to NetBox repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-29514 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-29514?: Check whether you run NetBox Labs NetBox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A remote code execution (RCE) vulnerability exists in NetBox's RenderTemplateMixin due to the insecure use of Django's import_string() function. The application allows users to provide an environment_params JSON field for Jinja2 templates, which includes a 'finalize' parameter resolved via import_string() without an allowlist. An authenticated attacker with 'exporttemplate' or 'configtemplate' permissions can set 'finalize' to a dangerous Python callable, such as 'subprocess.getoutput'. Because the 'finalize' callback is invoked by the Jinja2 environment internals outside of the SandboxedEnvironment's call interception mechanism, it effectively bypasses the sandbox. This allows the attacker to execute arbitrary shell commands as the NetBox service user. The issue is addressed in version 4.6.1 by implementing a strict allowlist for environment parameters.

Affected products

NetBox Labs NetBox 4.3.5 - 4.5.4

Timeline

2026-04-30: disclosed: Vulnerability details published by researcher Chocapikk
2026-05-04: advisory: CVE-2026-29514 published
2026-05-14: patched: Fix committed to NetBox repository
2026-05-21: other: NetBox v4.6.1 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.