CVE-2026-57207: CWE-306: Missing Authentication for Critical Function in netboxlabs netbox-mcp-server
Description
NetBox MCP Server versions prior to 1.2.1, when configured to use HTTP transport, lack authentication on the HTTP endpoint. This allows any client with network access to the MCP server port to establish a valid session and gain full read-only access to all four NetBox tools without requiring tokens or credentials. The vulnerability has been addressed in version 1.2.1.
CVSS v3.1
Score 5.9medium
Affected software
netboxlabs
netbox-mcp-server
pkg:github/netboxlabs/netbox-mcp-serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-57207 describes a missing authentication vulnerability (CWE-306) in netboxlabs netbox-mcp-server prior to version 1.2.1. When the MCP server is run with TRANSPORT=http, the HTTP endpoint does not enforce authentication, permitting any client that can reach the server port to obtain a valid MCP session. This grants unauthorized read-only access to all four NetBox tools. The issue was patched in version 1.2.1.
Potential Impact
An attacker with network access to the MCP server port can gain unauthorized read-only access to all four NetBox tools without authentication. This exposure could lead to information disclosure of sensitive data managed by NetBox. There is no impact on integrity or availability reported.
Mitigation Recommendations
Upgrade netbox-mcp-server to version 1.2.1 or later, where this authentication issue has been fixed. Prior to upgrading, avoid running the MCP server with TRANSPORT=http or restrict network access to the MCP server port to trusted clients only.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-24T02:00:46.801Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6adb689f4d27ba8daa2f82dd
Added to database: 10/23/2026, 14:01:03 UTC
Last enriched: 10/23/2026, 14:15:41 UTC
Last updated: 10/23/2026, 14:16:13 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.