Vulnerability · Published Aug 11, 2026 · Assigned by VulnCheck

CVE-2026-69117NetBox 4.5.8 ORM Injection via WritableNestedSerializer

Medium 6.5

In plain English

A medium-severity authorization bypass via user-controlled key in NetBox from NetBox Labs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 75.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any REST API endpoint. Attackers can exploit the unrestricted queryset used by WritableNestedSerializer to perform boolean-based blind data extraction of sensitive field values and bypass object-level permissions across all application modules including dcim, ipam, tenancy, virtualization, circuits, and extras.

Affected products (as reported)

Vendor	Product	Versions
NetBox Labs	NetBox	0 – through 4.5.8

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Product Repository product
GitHub Issue issue-tracking
Patch Commit patch
Pull Request issue-tracking
https://www.vulncheck.com/advisories/netbox-orm-injection-via-writablenestedserializer third-party-advisory