Skip to content
Heist/ feed
Back to feed
High

NetBox 4.5.8 ORM Injection via WritableNestedSerializer

Type: advisorySources: OSV

NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any REST API endpoint. Attackers can exploit the unrestricted queryset used by WritableNestedSerializer to perform boolean-based blind data extraction of sensitive field values and bypass object-level permissions across all application modules including dcim, ipam, tenancy, virtualization, circuits, and extras.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-69117
Confirmed fixed CVEs
Not specified
Updated in this feed
8 Nov 2026, 01:40 UTC · Revision 1

Source evidence

NetBox 4.5.8 ORM Injection via WritableNestedSerializer

core-osv · Original source

Published 11 Aug 2026, 18:29 UTC

NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any REST API endpoint. Attackers can exploit the unrestricted queryset used by WritableNestedSerializer to perform boolean-based blind data extraction of sensitive field values and bypass object-level permissions across all application modules including dcim, ipam, tenancy, virtualization, circuits, and extras.

osv:CVE-2026-69117
Complete source record
{
  "id": "a0944dab701681d78b509a3b6c3f72a335e0c7ed364e5375c0ada94925a775b1",
  "url": "https://osv.dev/vulnerability/CVE-2026-69117",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "NetBox 4.5.8 ORM Injection via WritableNestedSerializer",
    "summary": "NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any REST API endpoint. Attackers can exploit the unrestricted queryset used by WritableNestedSerializer to perform boolean-based blind data extraction of sensitive field values and bypass object-level permissions across all application modules including dcim, ipam, tenancy, virtualization, circuits, and extras.",
    "evidence": "osv:CVE-2026-69117",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-69117",
      "aliases": [
        "CVE-2026-69117"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/netbox-community/netbox",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "b3489cd529ca00703a0b7fe4c45e91539add6df6"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "4.5.8"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "fixed": "b3489cd529ca00703a0b7fe4c45e91539add6df6"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v4.6.0",
            "v4.5.10",
            "v4.5.9",
            "v4.5.8",
            "v4.5.7",
            "v4.5.6",
            "v4.5.5",
            "v4.5.4",
            "v4.5.2",
            "v4.5.3",
            "v4.5.1",
            "v4.5.0",
            "v4.4.10",
            "v4.4.9",
            "v4.4.8",
            "v4.4.7",
            "v4.4.6",
            "v4.4.5",
            "v4.4.4",
            "v4.4.3",
            "v4.4.2",
            "v4.4.1",
            "v4.4.0",
            "v4.3.7",
            "v4.3.6",
            "v4.3.5",
            "v4.3.4",
            "v4.3.3",
            "v4.3.2",
            "v4.3.1",
            "v4.3.0",
            "v4.2.9",
            "v4.2.8",
            "v4.2.7",
            "v4.2.6",
            "v4.2.5",
            "v4.2.4",
            "v4.0.0",
            "v4.2.3",
            "v4.2.2",
            "v4.2.1",
            "v4.2.0",
            "v4.1.7",
            "v4.1.6",
            "v4.1.5",
            "v4.1.3",
            "v4.1.2",
            "v4.1.1",
            "v4.1.0",
            "v4.0.11",
            "v4.0.10",
            "v4.0.9",
            "v4.0.8",
            "v4.0.7",
            "v4.0.6",
            "v4.0.5",
            "v4.0.3",
            "v4.0.2",
            "v4.0.1",
            "v3.7.8",
            "v3.7.7",
            "v3.7.6",
            "v3.7.5",
            "v3.7.4",
            "v3.7.3",
            "v3.7.2",
            "v3.7.0",
            "v3.6.9",
            "v3.6.8",
            "v3.6.7",
            "v3.6.6",
            "v3.6.5",
            "v3.6.4",
            "v3.6.3",
            "v3.6.2",
            "v3.6.1",
            "v3.6.0",
            "v3.5.9",
            "v3.5.8",
            "v3.5.7",
            "v3.5.6",
            "v3.5.5",
            "v3.5.4",
            "v3.5.3",
            "v3.5.2",
            "v3.5.1",
            "v3.5.0",
            "v3.4.10",
            "v3.4.9",
            "v3.4.8",
            "v3.4.7",
            "v3.4.6",
            "v3.4.5",
            "v3.4.4",
            "v3.4.3",
            "v3.4.2",
            "v3.4.1",
            "v3.4.0",
            "v3.3.10",
            "v3.3.9",
            "v3.3.8",
            "v3.3.7",
            "v3.3.6",
            "v3.3.5",
            "v3.3.4",
            "v3.3.2",
            "v3.3.3",
            "v3.3.1",
            "v3.3.0",
            "v3.2.9",
            "v3.2.8",
            "v3.2.7",
            "v3.2.6",
            "v3.2.5",
            "v3.2.3",
            "v3.2.2",
            "v3.2.1",
            "v3.2.0",
            "v3.1.11",
            "v3.1.10",
            "v3.1.9",
            "v3.1.8",
            "v3.1.7",
            "v3.1.6",
            "v3.1.5",
            "v3.1.4",
            "v3.1.3",
            "v3.1.2",
            "v3.1.1",
            "v3.1.0",
            "v3.0.12",
            "v3.0.11",
            "v3.0.10",
            "v3.0.9",
            "v3.0.8",
            "v3.0.7",
            "v3.0.5",
            "v3.0.4",
            "v3.0.3",
            "v3.0.2",
            "v3.0.1",
            "v3.0.0",
            "v2.11.12",
            "v2.11.11",
            "v2.11.10",
            "v2.11.9",
            "v2.11.8",
            "v2.11.7",
            "v2.11.6",
            "v2.11.5",
            "v2.11.4",
            "v2.11.3",
            "v2.11.2",
            "v2.11.1",
            "v2.11.0",
            "v2.10.10",
            "v2.10.9",
            "v2.10.8",
            "v2.10.7",
            "v2.10.6",
            "v2.10.5",
            "v2.10.4",
            "v2.10.3",
            "v2.10.2",
            "v2.10.1",
            "v2.10.0",
            "v2.9.11",
            "v2.9.10",
            "v2.9.9",
            "v2.9.8",
            "v2.9.7",
            "v2.9.6",
            "v2.9.5",
            "v2.9.4",
            "v2.9.3",
            "v2.9.2",
            "v2.9.1",
            "v2.9.0",
            "v2.8.9",
            "v2.8.8",
            "v2.8.7",
            "v2.8.6",
            "v2.8.4",
            "v2.8.3",
            "v2.8.2",
            "v2.8.1",
            "v2.8.0",
            "v2.7.12",
            "v2.7.11",
            "v2.7.10",
            "v2.7.9",
            "v2.7.8",
            "v2.7.7",
            "v2.7.6",
            "v2.7.5",
            "v2.7.4",
            "v2.7.3",
            "v2.7.2",
            "v2.7.1",
            "v2.7.0",
            "v2.6.12",
            "v2.6.11",
            "v2.6.10",
            "v2.6.9",
            "v2.6.7",
            "v2.6.8",
            "v2.6.6",
            "v2.6.5",
            "v2.6.4",
            "v2.6.3",
            "v2.5.13",
            "v2.6.2",
            "v2.6.1",
            "v2.6.0",
            "v2.5.12",
            "v2.5.11",
            "v2.5.10",
            "v2.5.9",
            "v2.5.8",
            "v2.5.7",
            "v2.5.6",
            "v2.5.5",
            "v2.5.4",
            "v2.5.3",
            "v2.5.2",
            "v2.5.1",
            "v2.5.0",
            "v2.4.9",
            "v2.4.8",
            "v2.4.7",
            "v2.4.6",
            "v2.4.5",
            "v2.4.4",
            "v2.4.3",
            "v2.4.2",
            "v2.4.1",
            "v2.4.0",
            "v2.3.7",
            "v2.3.6",
            "v2.3.5",
            "v2.3.4",
            "v2.3.3",
            "v2.3.2",
            "v2.3.1",
            "v2.3.0",
            "v2.2.10",
            "v2.2.9",
            "v2.2.8",
            "v2.2.7",
            "v2.2.6",
            "v2.2.5",
            "v2.2.4",
            "v2.2.3",
            "v2.2.2",
            "v2.2.1",
            "v2.2.0",
            "v2.1.6",
            "v2.1.5",
            "v2.1.4",
            "v2.1.3",
            "v2.1.2",
            "v2.1.1",
            "v2.1.0",
            "v2.0.10",
            "v2.0.9",
            "v2.0.8",
            "v2.0.7",
            "v2.0.6",
            "v2.0.5",
            "v2.0.4",
            "v2.0.3",
            "v2.0.2",
            "v2.0.1",
            "v2.0.0",
            "v1.9.6",
            "v1.9.5",
            "v1.9.4-r1",
            "v1.9.3",
            "v1.9.2",
            "v1.9.1",
            "v1.9.0-r1",
            "v1.8.4",
            "v1.8.3",
            "v1.8.2",
            "v1.8.1",
            "v1.8.0",
            "v1.7.3",
            "v1.7.2-r1",
            "v1.7.1",
            "v1.7.0",
            "v1.6.3",
            "v1.6.2-r1",
            "v1.6.1-r1",
            "1.6.1",
            "v1.6.0",
            "v1.5.2",
            "v1.5.1",
            "v1.4.2",
            "v1.4.0",
            "v1.3.0",
            "v1.2.1",
            "v1.2.0",
            "v1.1.0",
            "v1.0.7-r1",
            "v1.0.7",
            "v1.0.5",
            "v1.0.4",
            "v1.0.3-r1",
            "1.0.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69117.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:52.572780469Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69117.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-69117",
        "https://www.vulncheck.com/advisories/netbox-orm-injection-via-writablenestedserializer",
        "https://github.com/netbox-community/netbox/issues/21988",
        "https://github.com/netbox-community/netbox/pull/22013",
        "https://github.com/netbox-community/netbox/commit/b3489cd529ca00703a0b7fe4c45e91539add6df6",
        "https://github.com/netbox-community/netbox"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-639"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69117.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-69117",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 521434,
  "published_at": "2026-08-11T18:29:32.571+00:00"
}