Executive brief
NetBox is an open-source network source-of-truth platform used to centralize and automate network management. The platform fails to redact sensitive backend credentials (passwords and secret keys) from REST and GraphQL API responses, allowing authenticated users with minimal permissions to retrieve plaintext credentials for Git and Amazon S3 backends and gain unauthorized access to external repositories and storage buckets.
Technical details
NetBox through version 4.7.0 contains an information disclosure vulnerability where sensitive data source backend credentials are not properly redacted in API responses. The vulnerability affects both REST and GraphQL API endpoints and requires authentication, but can be exploited by users with only read/view permissions on data sources. An authenticated attacker can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through normal API queries, providing credentials to access external systems. The vulnerability is classified as credential exposure and impacts the confidentiality of backend access credentials.
Affected products
- NetBox Community NetBox through 4.7.0
Timeline
- 2026-09-05: disclosed