CVE-2026-104073

Summary

A server-side template injection vulnerability in NetBox allows low-privileged users to craft custom links that can steal session cookies and API tokens from other users by embedding request data directly into Jinja2 templates. This enables attackers to hijack user sessions and gain full access to their accounts.

Exploitability

Moderately difficult to exploit as it requires a user with 'Can add custom links' permission to create a malicious template, but once created, the attack automatically triggers when a privileged user views the affected object.

Blast radius

The vulnerability could lead to widespread account takeovers across the NetBox instance, especially if multiple users have elevated privileges or API access, as the attack can exfiltrate credentials without requiring user interaction beyond viewing an object.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to NetBox 4.7.0 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.