Read the docs
TI-2026-39687 Aliases CVE-2026-54918

Server-side request forgery in netbox-community devicetype-library

Priority LOW 24CWE-15Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-829.

Summary

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. In the affected repository revisions, NETBOX_DT_LIBRARY_URL in tests/test_configuration.py is a free-form tracked constant that an unauthenticated pull-request author can change before the validation test harness runs. During pytest collection, tests/definitions_test.py passes the value to Repo.clone_from and create_remote("upstream").fetch(), causing blind Git smart-HTTP requests to an attacker-selected host or loading attacker-controlled tests/known-*.json validation caches. The blind request cannot set arbitrary metadata-service headers or return response bodies, and this path does not execute remote Git hooks, but substituted known data can bypass slug, module, and rack uniqueness validation. This vulnerability is fixed in commit 8980c690097e92f5028c7e6df402b327d827ecd5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00415 36th percentileScored 2026-11-07
Fix Fixed devicetype-library (netbox-community): 8980c69

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
netbox-communitydevicetype-librarybefore 8980c698980c69Patch availableCNA
  • devicetype-library Vendornetbox-community Affected before 8980c69 Fixed in 8980c69 Patch available CNA

Remediation

  • Fix · CNA devicetype-library (netbox-community) Fixed in 8980c69

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54918

References

Other 3

  • TI-2026-39558 Deserialization of untrusted data in netbox-community devicetype-library CVSS 3.1CRITICAL 9.6
  • TI-2026-23330 NetBox 4.3.5 - 4.5.4 RCE via RenderTemplateMixin CVSS 4.0HIGH 8.7
  • TI-2026-39924 Code injection in netbox-community devicetype-library CVSS 3.1MEDIUM 6.5
  • TI-2026-58964 NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs CVSS 4.0HIGH 7.1
  • TI-2026-84457 Broken access control in NetBox bulk component creation CVSS 4.0MEDIUM 5.3
  • TI-2026-39685 Uncontrolled search path in netbox-community devicetype-library CVSS 3.1HIGH 8.8
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences