Authentication Weakness in NetBox MCP Server
CVE-2026-57207

5.9MEDIUM

Key Information:

Vendor

Netboxlabs

Status
Netbox-mcp-server
Vendor
CVE Published:
23 October 2026

What is CVE-2026-57207?

The NetBox MCP Server, a read-only Model Context Protocol server designed for NetBox, had an authentication flaw that allowed unauthorized access to sensitive endpoints. Prior versions, when operating over HTTP, lacked necessary security measures, enabling any client to establish a valid MCP session without requiring authentication tokens or credentials. This vulnerability compromises the integrity of the MCP services, allowing unrestricted access to all NetBox tools. The issue has been resolved in version 1.2.1, which introduces authentication protocols to protect against such unauthorized access.

Affected Version(s)

netbox-mcp-server < 1.2.1

References

https://github.com/netboxlabs/netbox-mcp-server/security/...
x_refsource_CONFIRM
https://github.com/netboxlabs/netbox-mcp-server/releases/...
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.