CVE-2023-27573 Hardcoded credentials in netbox-docker
NetBox Docker containers ship with default superuser credentials and API tokens, allowing attackers to gain administrative access if users fail to change them.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-27573?
CVE-2023-27573 is a critical vulnerability in netbox-community netbox-docker, published on 11 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
netbox-docker before 2.5.0 has a superuser account with default credentials (admin password for the admin account, and 0123456789abcdef0123456789abcdef01234567 value for SUPERUSER_API_TOKEN). In practice on the public Internet, almost all users changed the password but only about 90% changed the token. Having a default token value was intentional and was valuable for the main intended use case of the netbox-docker product (isolated development networks). Some users engaged in an effort to repurpose netbox-docker for production. The documentation for this effort stated that the defaults must not be used. However, installation did not ensure non-default values. The Supplier was aware of the CVE ID assignment and did not object to the assignment.
Which versions are affected by CVE-2023-27573?
It affects 1 product.
Products include Netboxlabs Netbox-Docker.
How do I fix CVE-2023-27573?
No fix has been published for CVE-2023-27573 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-27573 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-27573 exists.
Sources
Also known as GHSA-vf6r-c2jr-9wjq.