ORM Injection Vulnerability in NetBox 4.5.8 by NetBox Community

CVE-2026-69117

What is CVE-2026-69117?

NetBox 4.5.8 is susceptible to an ORM injection vulnerability that permits authenticated attackers, including those armed with read-only API tokens, to inject arbitrary Django ORM lookup expressions through crafted JSON dictionary keys. This can be done via POST, PUT, or PATCH requests directed at any REST API endpoint. By exploiting this weakness, attackers can manipulate the unrestricted queryset utilized by WritableNestedSerializer, enabling them to conduct boolean-based blind data extraction of sensitive field values and circumvent object-level permissions across all application modules such as dcim, ipam, tenancy, virtualization, circuits, and extras.

References