CVE-2026-69117: NetBox ORM Injection Vulnerability

CVE-2026-69117 Overview

CVE-2026-69117 is an Object-Relational Mapping (ORM) injection vulnerability in NetBox 4.5.8. Authenticated attackers, including those holding read-only API tokens, can inject arbitrary Django ORM lookup expressions into nested object references. Exploitation requires supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any REST API endpoint. The flaw resides in the unrestricted queryset used by WritableNestedSerializer. Attackers can perform boolean-based blind data extraction and bypass object-level permissions across every application module, including dcim, ipam, tenancy, virtualization, circuits, and extras. The weakness is classified under [CWE-639] (Authorization Bypass Through User-Controlled Key).

Critical Impact
Any authenticated user, including read-only API token holders, can extract sensitive field values and enumerate objects they are not permitted to view across all NetBox modules.

Affected Products

NetBox Community 4.5.8
NetBox REST API endpoints leveraging WritableNestedSerializer
Application modules: dcim, ipam, tenancy, virtualization, circuits, extras

Discovery Timeline

2026-08-11 - CVE-2026-69117 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-69117

Vulnerability Analysis

NetBox exposes writable nested serializers to accept related object references in REST API payloads. The serializer accepts a JSON dictionary whose keys are treated as Django ORM lookup expressions on an unrestricted queryset. Because the queryset does not enforce the requesting user's object-level permissions, an attacker can supply lookup keys that traverse arbitrary related fields and apply filter expressions such as __startswith, __gt, or __isnull. The API response differs based on whether the constructed lookup matches, producing a reliable boolean oracle.

Using this oracle, an attacker performs character-by-character blind extraction of sensitive field values, including secrets stored in related objects. The bypass applies uniformly across every REST endpoint that uses the vulnerable serializer, spanning inventory, network, and tenancy data.

Root Cause

The root cause is authorization enforced on the parent object but not on nested references. WritableNestedSerializer resolves nested lookups against the full model queryset instead of a queryset filtered by the caller's permissions. Untrusted dictionary keys are passed directly into the ORM as filter arguments, satisfying the pattern described by [CWE-639].

Attack Vector

The vulnerability is exploitable over the network with only a valid API token, including tokens marked read-only. No user interaction is required. The attacker issues POST, PUT, or PATCH requests to any REST endpoint accepting nested object references and observes response differences to infer field values.

python

# Security patch excerpt: netbox/dcim/api/serializers_/device_components.py
 from ipam.api.serializers_.vlans import VLANSerializer, VLANTranslationPolicySerializer
 from ipam.api.serializers_.vrfs import VRFSerializer
 from ipam.models import VLAN
-from netbox.api.fields import ChoiceField, ContentTypeField, SerializedPKRelatedField
+from netbox.api.fields import ChoiceField, ContentTypeField, RestrictedPrimaryKeyRelatedField, SerializedPKRelatedField
 from netbox.api.gfk_fields import GFKSerializerField
 from netbox.api.serializers import NetBoxModelSerializer
 from users.api.serializers_.mixins import OwnerMixin
# Source: https://github.com/netbox-community/netbox/commit/b3489cd529ca00703a0b7fe4c45e91539add6df6

The patch introduces RestrictedPrimaryKeyRelatedField, which constrains nested object lookups to querysets respecting the caller's permissions.

python

# Security patch excerpt: netbox/dcim/api/serializers_/devicetype_components.py
     PowerPortTemplate,
     RearPortTemplate,
 )
-from netbox.api.fields import ChoiceField, ContentTypeField
+from netbox.api.fields import ChoiceField, ContentTypeField, RestrictedPrimaryKeyRelatedField
 from netbox.api.gfk_fields import GFKSerializerField
 from netbox.api.serializers import ChangeLogMessageSerializer, ValidatedModelSerializer
 from wireless.choices import *
# Source: https://github.com/netbox-community/netbox/commit/b3489cd529ca00703a0b7fe4c45e91539add6df6

Detection Methods for CVE-2026-69117

Indicators of Compromise

POST, PUT, or PATCH requests to NetBox REST endpoints containing nested JSON objects whose keys include ORM lookup suffixes such as __startswith, __gt, __lt, __isnull, __regex, or __contains.
High volume of similar API requests from a single token, differing only by one character in a nested key value, consistent with boolean-based blind extraction.
API activity from read-only tokens that repeatedly touches modules the associated user has no operational reason to access.

Detection Strategies

Parse NetBox application logs and reverse proxy access logs for request bodies containing double-underscore lookup patterns inside nested dictionaries.
Alert on API tokens that generate anomalous request rates against /api/dcim/, /api/ipam/, /api/tenancy/, /api/virtualization/, /api/circuits/, and /api/extras/ endpoints.
Correlate 4xx and 2xx response patterns per token to identify oracle-style probing where response bodies alternate based on nested key values.

Monitoring Recommendations

Forward NetBox API and gunicorn logs to a centralized log platform and retain full request bodies for the affected endpoints.
Baseline normal REST API usage per token and alert on deviations in payload structure, endpoint diversity, or request cadence.
Review API token inventory and revoke tokens that are unused, over-privileged, or unattributed.

How to Mitigate CVE-2026-69117

Immediate Actions Required

Upgrade NetBox to a fixed release that incorporates the changes from pull request #22013.
Rotate all NetBox API tokens after upgrading to invalidate any tokens that may have been used for extraction.
Audit recent API activity for the request patterns described in the Indicators of Compromise section.

Patch Information

The fix is delivered in commit b3489cd, which replaces unrestricted primary key fields with RestrictedPrimaryKeyRelatedField across the affected serializers. Additional context is available in the NetBox issue #21988 and the VulnCheck NetBox ORM Injection Advisory.

Workarounds

Restrict network reachability of the NetBox REST API to trusted management networks until the patch is applied.
Reduce the number of active API tokens and remove tokens that are not strictly required for automation.
Place a reverse proxy or web application firewall in front of NetBox and block request bodies whose nested JSON keys contain Django ORM lookup suffixes.

bash

# Example NGINX rule to block requests containing ORM lookup suffixes in JSON keys
location /api/ {
    if ($request_method ~ ^(POST|PUT|PATCH)$) {
        set $orm_probe 0;
    }
    if ($request_body ~* "\"[a-z_]+__(startswith|endswith|contains|icontains|regex|iregex|gt|gte|lt|lte|isnull|in|exact|iexact)\"\s*:") {
        set $orm_probe 1;
    }
    if ($orm_probe = 1) {
        return 403;
    }
    proxy_pass http://netbox_upstream;
}