Description

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to external repositories and storage buckets.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-05T11:16:46.123Z",
  "pubdate": "2026-09-05T11:16:46.123Z",
  "executiveSummary": "NetBox versions through 4.7.0 are susceptible to an information disclosure vulnerability within the REST and GraphQL API interfaces. The application fails to properly redact sensitive backend credentials, specifically those associated with Git and Amazon S3 data sources. Consequently, authenticated users possessing minimal read-only permissions can programmatically extract plaintext passwords and secret keys directly from API responses. This exposure poses a severe security risk, as compromised credentials may allow attackers to gain unauthorized access to external repositories and cloud storage buckets integrated with the NetBox instance. The vulnerability allows an authenticated actor to escalate privileges horizontally by leveraging exfiltrated secrets to access third-party systems, potentially leading to unauthorized data modification, exfiltration, or infrastructure compromise. The issue stems from insufficient input/output sanitization within the serialization layer of the API, which ignores established security policies for sensitive data fields. No special exploitation conditions beyond standard API authentication are required to trigger this disclosure.",
  "technicalDetails": "The vulnerability resides within the API serialization layer of NetBox, which fails to apply necessary filtering or redaction mechanisms to configuration objects containing sensitive authentication material. When an authenticated user queries REST or GraphQL endpoints that retrieve metadata regarding configured data sources, the backend includes credential attributes—such as passwords for Git repositories or AWS Secret Access Keys for S3 backends—in the JSON/GraphQL response body in cleartext. This indicates that the Data Source model objects are being serialized for API transport without the application of appropriate 'sensitive' field masking or post-processing sanitization.\nThe attack flow is straightforward: 1) An attacker authenticates to the NetBox instance using a valid user account, regardless of the assigned permission level, provided the account possesses at least 'view' access to the relevant data source configuration. 2) The attacker sends a request to the REST API (e.g., /api/extras/data-sources/) or the GraphQL equivalent. 3) The server returns a serialized representation of the data source objects. 4) The attacker parses the response, locating the fields containing sensitive authentication information that should have been masked or omitted by the API provider. 5) With these credentials, the attacker performs out-of-band authentication against the external Git provider or the S3 storage service.\nThis behavior is consistent across versions up to and including 4.7.0. Because the API endpoints do not distinguish between administrative and read-only users when serializing the object model, the vulnerability is exposed even to low-privileged accounts. The absence of a centralized credential redaction middleware allows sensitive fields to propagate from the database layer to the presentation layer via the API framework. Post-exploitation, an attacker can manipulate or exfiltrate data from integrated S3 buckets or commit unauthorized changes/sub-module injections into Git repositories used by NetBox for automation or data syncing. The impact is essentially a total loss of confidentiality for the external infrastructure credentials managed within NetBox."
}