CVE-2026-57207 Details
Description
NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox. Prior to version 1.2.1, when running with TRANSPORT=http, the MCP server has no authentication on the HTTP endpoint. Any client that can reach the port gets a valid MCP session and full access to all four NetBox tools - no token or credential needed. This issue has been patched in version 1.2.1.
An authentication bypass vulnerability has been identified in NetBox MCP Server versions prior to 1.2.1, when running with HTTP transport. The server does not require authentication for the HTTP endpoint, allowing any client that can access the port to initiate a valid MCP session. This session grants full access to all four NetBox tools without the need for a token or credentials. The vulnerability arises because the server only applies CORS middleware and does not enforce authentication by default, leaving the endpoint completely open.
Users can upgrade to NetBox MCP Server version 1.2.1 or later, which introduces optional bearer token authentication for the HTTP transport. Instructions for adding this authentication are available in the NetBox MCP Server repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/netboxlabs/netbox-mcp-server/security/advisories/GHSA-5qg7-j8mr-9477 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/netboxlabs/netbox-mcp-server/releases/tag/v1.2.1 | [email protected] | Release NotesVendor |
| https://github.com/netboxlabs/netbox-mcp-server/security/advisories/GHSA-5qg7-j8mr-9477 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1059 | Insufficient Technical Documentation | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NetBox MCP Server | <= 1.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |