Read the docs
TI-2026-68595 Aliases CVE-2026-104073GHSA-hwq6-cq8c-9m9m

Template injection in NetBox custom links leaks session cookies

Priority LOW 30CWE-668Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure, Cross-site scripting
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-668, CWE-79 and the CVSS impact.

Summary

NetBox versions from 2.9.5 before 4.7.0 contain a server-side template injection flaw in custom link templates (CWE-668). The Jinja2 template context exposes the raw Django HttpRequest object, and an img src URL bypasses the clean_html sanitizer. A low-privileged user with the "Can add custom links" permission can steal the session cookies and API tokens of other users when a privileged user views the object, enabling full account takeover.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template context. Attackers can craft a custom link template embedding request.COOKIES['sessionid'] or a user's API token into an img src URL, which bypasses the clean_html sanitizer and auto-exfiltrates the victim's credentials to an attacker-controlled host when a privileged user views the object, enabling full account takeover.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00365 30th percentileScored 2026-11-07
Fix Fixed netbox (netbox-community): 4.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
netbox-communitynetbox2.9.5 to before 4.7.04.7.0Patch availableCNA
  • netbox Vendornetbox-community Affected 2.9.5 to before 4.7.0 Fixed in 4.7.0 Patch available CNA

Remediation

Upgrade NetBox to version 4.7.0.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA netbox (netbox-community) Fixed in 4.7.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-104073
  2. 2026-10-07 Alias added: GHSA-hwq6-cq8c-9m9m
  3. 2026-10-07 CISA SSVC decision points changed
  4. 2026-10-07 Priority changed: MEDIUM → LOW
  5. 2026-10-07 Affected versions changed · Red Hat
  6. 2026-10-07 CVSS score added · Red Hat

References

Patch 1

Other 2

  • TI-2026-39558 Deserialization of untrusted data in netbox-community devicetype-library CVSS 3.1CRITICAL 9.6
  • TI-2026-23330 NetBox 4.3.5 - 4.5.4 RCE via RenderTemplateMixin CVSS 4.0HIGH 8.7
  • TI-2026-39924 Code injection in netbox-community devicetype-library CVSS 3.1MEDIUM 6.5
  • TI-2026-58964 NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs CVSS 4.0HIGH 7.1
  • TI-2026-84457 Broken access control in NetBox bulk component creation CVSS 4.0MEDIUM 5.3
  • TI-2026-39685 Uncontrolled search path in netbox-community devicetype-library CVSS 3.1HIGH 8.8
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences