---
id: CVE-2026-69117
title: >-
  NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated
  attackers, including those with read-only API tokens, to inject arbitrary
  Django ORM lookup expressions into nested object references by supplying
  crafted JSO…
summary: >-
  NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated
  attackers, including those with read-only API tokens, to inject arbitrary
  Django ORM lookup expressions into nested object references by supplying
  crafted JSO…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-639
published: '2026-08-11'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:30:25.373'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-69117'
references:
  - url: 'https://github.com/netbox-community/netbox'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/netbox-community/netbox/commit/b3489cd529ca00703a0b7fe4c45e91539add6df6
    label: disclosure@vulncheck.com
  - url: 'https://github.com/netbox-community/netbox/issues/21988'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/netbox-community/netbox/pull/22013'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/netbox-orm-injection-via-writablenestedserializer
    label: disclosure@vulncheck.com
  - url: 'https://github.com/netbox-community/netbox/issues/21988'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00436
epssPercentile: 0.35164
ingestedAt: '2026-09-24T20:51:40.194Z'
---

## Overview

NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any REST API endpoint. Attackers can exploit the unrestricted queryset used by WritableNestedSerializer to perform boolean-based blind data extraction of sensitive field values and bypass object-level permissions across all application modules including dcim, ipam, tenancy, virtualization, circuits, and extras.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.