CVE-2026-86175

NetBox through 4.7.0 fails to redact sensitive credentials for Git and Amazon S3 data source backends in REST and GraphQL API responses (CWE-522, Insufficiently Protected Credentials). An attacker needs only a valid low-privilege account with view permission; querying the affected API endpoints over the network returns backend passwords and secret keys in plaintext. With those credentials, an attacker gains unauthorized access to the external Git repositories and S3 buckets that the NetBox instance integrates with, extending the impact beyond the NetBox instance itself. Any deployment running version 4.7.0 or earlier where untrusted or minimally privileged users hold view access and data source backends are configured is affected. There is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.3% probability of exploitation within 30 days, so no exploitation is currently known.

What to do: Upgrade NetBox to the first release published after 4.7.0 that restores credential redaction for data source backends, as no fixed version is specified in the available data. Until then, limit view permissions on data source objects to trusted staff, audit API tokens held by low-privilege users, and check API access logs for data source queries by non-administrative accounts. If untrusted users had view access to instances with Git or S3 backends, rotate those backend credentials and review repository and bucket access logs for signs of unauthorized use.