netbox-mcp-server vulnerabilities

CVEs whose affected-version data names the netbox-mcp-server package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-57207Medium· 5.9

today

NetBox MCP Server: HTTP transport exposes all NetBox data without authentication

NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox. Prior to version 1.2.1, when running with TRANSPORT=http, the MCP server has no authentication on the HTTP endpoint. Any client that can reach the port get…

▾ Sunlitnetboxlabs · netbox-mcp-servervia CVEORG