CVE-2023-27573

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-11 · updated 2026-06-17
Weakness: CWE-1392

Description

netbox-docker before 2.5.0 has a superuser account with default credentials (admin password for the admin account, and 0123456789abcdef0123456789abcdef01234567 value for SUPERUSER_API_TOKEN). In practice on the public Internet, almost all users changed the password but only about 90% changed the token. Having a default token value was intentional and was valuable for the main intended use case of the netbox-docker product (isolated development networks). Some users engaged in an effort to repurpose netbox-docker for production. The documentation for this effort stated that the defaults must not be used. However, installation did not ensure non-default values. The Supplier was aware of the CVE ID assignment and did not object to the assignment.

Affected products

netbox-community netbox-docker: before 2.5.0 — fixed in 2.5.0

How to fix

Upgrade to a fixed version: netbox-community netbox-docker 2.5.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-27573 or the next vulnerability affects your stack