CVE-2026-86176 NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark...

CVE-2026-86176

NetBox through 4.7.0 fails to properly scope user-private records in its REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks . The root cause is the use of unscoped querysets , which allows any authenticated user with view permissions to access all users' private record...

CVE-2026-86175 NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...

CVE-2026-86175 NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...

CVE-2026-86175

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses . Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, enabling unauthorized access to e...

EUVD-2026-71974

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...

CVE-2026-86175 NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...

CVE-2026-86175: Insufficiently Protected Credentials

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...

PT-2026-86399

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...

PT-2026-86400

Name of the Vulnerable Software and Affected Versions NetBox versions prior to 4.7.1 Description Authenticated users with view permissions can access private records of all users due to improper scoping of querysets. This issue affects the REST and GraphQL API endpoints for Notifications,...

CVE-2026-86176: Authorization Bypass Through User-Controlled Key

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark...

CVE-2026-73229 vulnerabilities

Vulnerabilities for packages: authentik-fips, netbox, authentik, awx, netbox-fips...

GHSA-2M8G-3CMR-WG3W vulnerabilities

Vulnerabilities for packages: authentik-fips, netbox, authentik, awx, netbox-fips...

GHSA-G47C-3XMW-Q6M2 vulnerabilities

Vulnerabilities for packages: authentik-fips, netbox, authentik, awx, netbox-fips...

CVE-2026-73228 vulnerabilities

Vulnerabilities for packages: authentik-fips, netbox, authentik, awx, netbox-fips...

CVE-2026-54284 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, openstack-nova-2025.2, openstack-keystone-2026.1-fips, netbox, openstack-glance-2025.1, openstack-nova-2026.1, openstack-horizon-2025.2, openstack-keystone-2025.1, openstack-glance-2025.2-fips, mlflow, openstack-glance-2025.1-fips,...

CVE-2026-59893 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, openstack-nova-2025.2, openstack-keystone-2026.1-fips, netbox, openstack-glance-2025.1, openstack-nova-2026.1, openstack-horizon-2025.2, openstack-keystone-2025.1, openstack-glance-2025.2-fips, mlflow, openstack-glance-2025.1-fips,...

GHSA-PWGV-4X5Q-6M9F vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, openstack-nova-2025.2, openstack-keystone-2026.1-fips, netbox, openstack-glance-2025.1, openstack-nova-2026.1, openstack-horizon-2025.2, openstack-keystone-2025.1, openstack-glance-2025.2-fips, mlflow, openstack-glance-2025.1-fips,...

GHSA-3496-9G83-7V6X vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, openstack-nova-2025.2, openstack-keystone-2026.1-fips, netbox, openstack-glance-2025.1, openstack-nova-2026.1, openstack-horizon-2025.2, openstack-keystone-2025.1, openstack-glance-2025.2-fips, mlflow, openstack-glance-2025.1-fips,...

CVE-2026-59894 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, openstack-nova-2025.2, openstack-keystone-2026.1-fips, netbox, openstack-glance-2025.1, openstack-nova-2026.1, openstack-horizon-2025.2, openstack-keystone-2025.1, openstack-glance-2025.2-fips, mlflow, openstack-glance-2025.1-fips,...