MEDIUM 5.9 NVD

CVE-2026-57207

NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox. Prior to version 1.2.1, when running with TRANSPORT=http, the MCP server has n

NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox. Prior to version 1.2.1, when running with TRANSPORT=http, the MCP server has no authentication on the HTTP endpoint. Any client that can reach the port gets a valid MCP session and full access to all four NetBox tools - no token or credential needed. This issue has been patched in version 1.2.1.

References

https://github.com/netboxlabs/netbox-mcp-server/releases/tag/v1.2.1
https://github.com/netboxlabs/netbox-mcp-server/security/advisories/GHSA-5qg7-j8mr-9477

Published: 2026-10-23 · Source: NVD · Feed updated: 2026-10-23

This medium severity vulnerability with a CVSS score of 5.9 was published on 2026-10-23 via NVD.

vulnfeed aggregates 15176 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.