# CVE-2026-86175: NetBox information disclosure in REST and GraphQL API

Source: https://junglewise.ai/threats/cve-2026-86175-netbox-information-disclosure-in-rest-and-graphql-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-05. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86175 · Severity: medium · CVSS 6.5 · Published 2026-09-05

NetBox is an open-source network source-of-truth platform used to centralize and automate network management. The platform fails to redact sensitive backend credentials (passwords and secret keys) from REST and GraphQL API responses, allowing authenticated users with minimal permissions to retrieve plaintext credentials for Git and Amazon S3 backends and gain unauthorized access to external repositories and storage buckets.

## Quick answers

**Is CVE-2026-86175 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86175 being exploited in the wild.

**How severe is CVE-2026-86175?** Medium severity, with a CVSS score of 6.5, published 5 September 2026.

**Which products and versions are affected?** NetBox Community NetBox through 4.7.0.

**Is there a fix for CVE-2026-86175?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-86175 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86175?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

NetBox through version 4.7.0 contains an information disclosure vulnerability where sensitive data source backend credentials are not properly redacted in API responses. The vulnerability affects both REST and GraphQL API endpoints and requires authentication, but can be exploited by users with only read/view permissions on data sources. An authenticated attacker can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through normal API queries, providing credentials to access external systems. The vulnerability is classified as credential exposure and impacts the confidentiality of backend access credentials.

## Affected products

- NetBox Community NetBox through 4.7.0

## Timeline

- 2026-09-05: disclosed

## References

- [https://github.com/geo-chen/oss/blob/main/netbox.md](https://github.com/geo-chen/oss/blob/main/netbox.md)
- [https://github.com/netbox-community/netbox](https://github.com/netbox-community/netbox)