What’s Vulnerable › Vulnerabilities

CVE-2026-104073: NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links

• Severity: high (CVSS 7.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-06 · updated 2026-10-27
• Weakness: CWE-668

Description

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template context. Attackers can craft a custom link template embedding request.COOKIES['sessionid'] or a user's API token into an img src URL, which bypasses the clean_html sanitizer and auto-exfiltrates the victim's credentials to an attacker-controlled host when a privileged user views the object, enabling full account takeover.

Affected products

• netbox-community netbox: from 2.9.5 before 4.7.0 — fixed in 4.7.0

How to fix

Upgrade to a fixed version: netbox-community netbox 4.7.0. Check the vendor advisory for mitigations.

References

• https://github.com/netbox-community/netbox/issues/22607
• https://github.com/netbox-community/netbox/pull/22616
• https://github.com/netbox-community/netbox/releases#release-v4.7.0
• https://www.vulncheck.com/advisories/netbox-session-hijacking-via-custom-links

Get alerted when CVE-2026-104073 or the next vulnerability affects your stack