Threat
NVD-CVE-2026-57207
Publication date unknown · Discovered nist.gov
Page published
Publication date unknown · First observed: 9 Nov 2026
Coverage timeline
Single-source advisory — one report is available.
Why it matters
NetBox MCP Server deployments using the vulnerable HTTP transport expose NetBox tool access to unauthenticated clients, creating a confidentiality risk that defenders should address by upgrading to version 1.2.1.
CVE-2026-57207 affects NetBox MCP Server before version 1.2.1: deployments using TRANSPORT=http lack authentication on the HTTP endpoint, allowing any client that can reach the port to obtain an MCP session and access all four read-only NetBox tools without credentials. Version 1.2.1 fixes the vulnerability.