{"schema":"threatline.record/2","record":{"id":"CVE-2026-57207","aliases":["GHSA-5qg7-j8mr-9477"],"summary":"NetBox MCP Server: HTTP transport exposes all NetBox data without authentication","details":"NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox. Prior to version 1.2.1, when running with TRANSPORT=http, the MCP server has no authentication on the HTTP endpoint. Any client that can reach the port gets a valid MCP session and full access to all four NetBox tools - no token or credential needed. This issue has been patched in version 1.2.1.","categories":["Unclassified"],"product":"netbox-mcp-server","vendor":"netboxlabs","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-57207","source_modified_at":"2026-10-23T13:40:31.164Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"netbox-mcp-server","vendor":"netboxlabs","versions":[{"version":"< 1.2.1","status":"affected"}],"defaultStatus":null},{"source":"GitHub Advisory Database","source_url":"https://github.com/netboxlabs/netbox-mcp-server/security/advisories/GHSA-5qg7-j8mr-9477","source_modified_at":"2026-06-24T02:26:09Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"","name":"netbox-mcp-server"},"range":"<= 1.2.0"}],"fixed_versions":[],"cvss":5.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-23T13:40:31.164Z","modified_at":"2026-10-23T13:40:31.164Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-57207","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T13:40:31.164Z"},{"source":"GitHub Advisory Database","url":"https://github.com/netboxlabs/netbox-mcp-server/security/advisories/GHSA-5qg7-j8mr-9477","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-06-24T02:26:09Z"}],"sources":["CVE List","GitHub Advisory Database"],"references":[{"source":"CVE List","url":"https://github.com/netboxlabs/netbox-mcp-server/security/advisories/GHSA-5qg7-j8mr-9477","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/netboxlabs/netbox-mcp-server/releases/tag/v1.2.1","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-23T13:40:31.164Z","content_hash":"52d6d544c3fd18ac2538158c0320be84be01535668c6365f9100d7b2856687fa"}}