---
id: CVE-2026-86175
title: >-
  NetBox through 4.7.0 fails to redact sensitive data source backend credentials
  in REST and GraphQL API responses
summary: >-
  NetBox through 4.7.0 fails to redact sensitive data source backend credentials
  in REST and GraphQL API responses. Authenticated users with only view
  permission can retrieve plaintext passwords and secret keys for Git and Amazon
  S3 backen…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-522
vendor: netbox-community
product: netbox
affected:
  - netbox <= 4.7.0
published: '2026-09-05'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:00:18.870'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86175'
references:
  - url: >-
      https://github.com/geo-chen/oss/blob/main/netbox.md#finding-2-netbox-data-source-backend-credentials-git-password--s3-secret-key-returned-in-plaintext-via-rest-api-and-graphql-to-users-with-only-view-permission-incomplete-fix-of-12625
    label: disclosure@vulncheck.com
  - url: 'https://github.com/netbox-community/netbox'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/netbox-community/netbox/blob/v4.7.0/netbox/core/api/serializers_/data.py#L26-L32
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/netbox-community/netbox/blob/v4.7.0/netbox/core/data_backends.py#L80
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/netbox-community/netbox/blob/v4.7.0/netbox/core/graphql/types.py#L30-L38
    label: disclosure@vulncheck.com
  - url: 'https://github.com/netbox-community/netbox/issues/12625'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/netbox-through-4.7.0-credential-disclosure-via-rest-and-graphql-apis
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00464
epssPercentile: 0.37575
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-08T13:13:05.582427Z'
ingestedAt: '2026-09-06T07:51:56.538Z'
---

## Overview

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to external repositories and storage buckets.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.