CVE-2026-29514 Details
Description
NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the RenderTemplateMixin.get_environment_params() method that allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary code by specifying malicious Python callables in the environment_params field. Attackers can bypass Jinja2 SandboxedEnvironment protections by setting the finalize parameter to any importable Python callable such as subprocess.getoutput, which is invoked on every rendered expression outside the sandbox's call interception mechanism, achieving remote code execution as the NetBox service user.
A remote code execution vulnerability has been identified in NetBox versions 4.3.5 prior to 4.5.4. The issue arises in the RenderTemplateMixin.get_environment_params() method, where authenticated users with exporttemplate or configtemplate permissions can execute arbitrary code. This is achieved by injecting malicious Python callables into the environment_params field, which are then executed during template rendering. The vulnerability bypasses Jinja2's SandboxedEnvironment protections by using the finalize parameter to introduce importable Python callables, such as subprocess.getoutput, into the rendering process. As a result, the injected code is executed with the privileges of the NetBox service user.
NetBox has released a patch for this vulnerability in version 4.5.5. Users should update to this version. For those using the Docker image, ensure to pull the latest version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 4, 2026CISA-ADP
Assessed May 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://chocapikk.com/posts/2026/netbox-export-template-rce/ | [email protected] | ExploitRemedyTechnical Analysis |
| https://github.com/netbox-community/netbox/commit/d124c5fe86e12aad61285133c0caf16adcda8f2e | [email protected] | |
| https://github.com/netbox-community/netbox/issues/22079 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/netbox-community/netbox/pull/22078 | [email protected] | Source CodeVendor |
| https://github.com/netbox-community/netbox/pull/22170 | [email protected] | |
| https://github.com/netbox-community/netbox/releases/tag/v4.6.1 | [email protected] | |
| https://www.vulncheck.com/advisories/netbox-rce-via-rendertemplatemixin | [email protected] | AdvisoryBundleExploit |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-183 | Permissive List of Allowed Inputs | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NetBox | >= 4.3.5, <= 4.5.4 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | CVE Modified | [email protected] |
| May 4, 2026 | New CVE Received | [email protected] |