CVE-2026-29514 - Vulnerability Analysis

Overview

NetBox 4.3.5 through 4.5.4 contains a remote code execution vulnerability caused by improper handling of environment_params in RenderTemplateMixin.get_environment_params(), letting authenticated users with exporttemplate or configtemplate permissions execute arbitrary code by specifying malicious Python callables, exploit requires specific permissions.

Severity & Score

Impact

Authenticated users with specific permissions can execute arbitrary code as the NetBox service user, potentially compromising the entire system.

Mitigation

Update to the latest version beyond 4.5.4.

References

• https://chocapikk.com/posts/2026/netbox-export-template-rce/
• https://github.com/netbox-community/netbox/issues/22079
• https://github.com/netbox-community/netbox/pull/22078
• https://www.vulncheck.com/advisories/netbox-rce-via-rendertemplatemixin

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner