PT-2026-36830 · Netbox Community · Netbox

Valentin Lobstein · Published 2026-05-04 · Updated 2026-05-21 · CVE-2026-29514

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NetBox versions 4.3.5 through 4.5.4

Description An issue in the RenderTemplateMixin.get environment params() method allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary code. By specifying malicious Python callables in the environment params field, attackers can bypass Jinja2 SandboxedEnvironment protections. This is achieved by setting the finalize parameter to an importable Python callable, such as subprocess.getoutput, which is then invoked on every rendered expression outside the sandbox's call interception mechanism, resulting in remote code execution as the NetBox service user.

Recommendations Update NetBox to a version later than 4.5.4. As a temporary workaround, restrict the exporttemplate and configtemplate permissions to only trusted users.

Exploit

Fix

RCE

Weakness Enumeration

CWE-183

Related Identifiers

CVE-2026-29514

Affected Products

Netbox

References · 10

• 🔥 https://chocapikk.com/posts/2026/netbox-export-template-rce · Exploit
• https://github.com/netbox-community/netbox/commit/d124c5fe86e12aad61285133c0caf16adcda8f2e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-29514 · Security Note
• https://github.com/netbox-community/netbox/releases/tag/v4.6.1 · Note
• https://github.com/netbox-community/netbox/pull/22170 · Note
• https://github.com/netbox-community/netbox/pull/22078 · Note
• https://github.com/netbox-community/netbox/issues/22079 · Note
• https://t.me/cveNotify/164405 · Telegram Post
• https://vulncheck.com/advisories/netbox-rce-via-rendertemplatemixin · Note
• https://twitter.com/N45HTOfficial/status/2056587823273357734 · Twitter Post