CVE-2026-69117

CVE-2026-69117 is an ORM injection vulnerability in NetBox's nested serializers that allows authenticated attackers with read-only API tokens to extract arbitrary field values across all modules—including dcim, ipam, tenancy, virtualization, circuits, and extras. The CVSS 6.5 rating is misleading: the real issue is a complete collapse of the read-only permission model at the serializer layer. The vulnerability exploits a fundamental architectural flaw: NetBox's WritableNestedSerializer operates with unrestricted queryset access that bypasses the token's stated permissions. When a read-only token makes a request, the serializer still resolves nested object references using full queryset privileges rather than respecting the token's scope. This is not input validation failure—it is a boundary failure where the security check was placed in the wrong architectural layer. The attack surface is structurally novel: exploitation occurs through JSON dictionary keys rather than values. The framework internally translates dictionary keys into ORM lookups (effectively Django Q objects), which means traditional input validation focusing on parameter values misses the actual exploit vector. Most defensive monitoring is calibrated for anomalous data access patterns, but this technique uses true/false boolean responses to infer values blind—leaving no obvious anomaly signature. The boolean-based extraction is efficient and low-noise. An attacker iterates through field names, submitting keys like `{"site": {"name__startswith": "A"}}` and observing whether the request succeeds or fails. Each character guessed this way narrows the possible value until the entire field is reconstructed. This is a systemic issue. The cross-module impact indicates that multiple NetBox modules independently implemented similar serializer patterns rather than inheriting from a hardened base with proper permission propagation. The WritableNestedSerializer naming itself is a design smell—it implies a contract (writable operations) that the implementation does not honor when invoked under read-only tokens. The low EPSS score (0.0025) likely reflects the authentication requirement, but in practice, API tokens proliferate in NetBox deployments for automation scripts, monitoring integrations, and CI/CD pipelines. If your environment follows the common practice of using read-only tokens for these purposes, the actual attack surface may be substantially larger than the base metric suggests. The critical unresolved question is whether this is a direct ORM expression injection (malicious keys parsed as Django lookups) or a queryset privilege bypass where nested serializer resolution ignores token permissions entirely. This distinction matters for remediation: the former requires input sanitization at the key-parsing layer, the latter requires architectural changes to how serializers inherit and enforce permission context. Audit your serializer inheritance chain to determine which applies to your deployment, and treat any read-only token as potentially capable of cross-module data access until the patch is applied.

Reviewed through automated stages and approved by a human before publication.