# CVE-2026-69117: NetBox ORM injection in REST API nested object references

Source: https://junglewise.ai/threats/cve-2026-69117-netbox-orm-injection-in-rest-api-nested-object-references  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-69117 · Severity: medium · CVSS 6.5 · Published 2026-08-11

NetBox is a network infrastructure management platform used by organizations to track and automate network resources. An ORM injection vulnerability allows authenticated users, including those with read-only API access, to extract sensitive data from the database and bypass security permissions across all modules. An attacker could exfiltrate confidential network configuration details or gain unauthorized access to restricted information.

## Quick answers

**Is CVE-2026-69117 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69117 being exploited in the wild.

**How severe is CVE-2026-69117?** Medium severity, with a CVSS score of 6.5, published 11 August 2026.

**Which products and versions are affected?** NetBox NetBox 4.5.8.

**Is there a fix for CVE-2026-69117?** A patch was published on 2026-06-22: Fix applied in commit b3489cd before disclosure Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-69117 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-69117?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an ORM (Object-Relational Mapping) injection flaw in the WritableNestedSerializer component of NetBox's REST API. Attackers can inject arbitrary Django ORM lookup expressions by crafting malicious JSON dictionary keys in POST, PUT, or PATCH requests to any REST API endpoint. No special privileges are required—attackers with read-only API tokens can exploit this. The flaw enables boolean-based blind data extraction from sensitive fields and allows circumventing object-level permission checks across dcim, ipam, tenancy, virtualization, circuits, and extras modules. A patch was released in commit b3489cd to enforce object permissions for nested related objects.

## Affected products

- NetBox NetBox 4.5.8

## Timeline

- 2026-08-11: disclosed
- 2026-06-22: patched: Fix applied in commit b3489cd before disclosure

## References

- [https://github.com/netbox-community/netbox](https://github.com/netbox-community/netbox)
- [https://github.com/netbox-community/netbox/commit/b3489cd529ca00703a0b7fe4c45e91539add6df6](https://github.com/netbox-community/netbox/commit/b3489cd529ca00703a0b7fe4c45e91539add6df6)