CVE-2023-27573

netbox-docker before 2.5.0 has a superuser account with default credentials (admin password for the admin account, and 0123456789abcdef0123456789abcdef01234567 value for SUPERUSER_API_TOKEN). In practice on the public Internet, almost all users changed the password but only about 90% changed the token. Having a default token value was intentional and was valuable for the main intended use case of the netbox-docker product (isolated development networks). Some users engaged in an effort to repurpose netbox-docker for production. The documentation for this effort stated that the defaults must not be used. However, installation did not ensure non-default values. The Supplier was aware of the CVE ID assignment and did not object to the assignment.

• CWE-1392
• CWE-798

• https://github.com/netbox-community/netbox-docker/issues/953Exploit, Issue Tracking
• https://github.com/netbox-community/netbox-docker/pull/959Issue Tracking, Patch
• https://github.com/netbox-community/netbox-docker/releases/tag/2.5.0Release Notes

Published

Mar 11, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-27568SQL injection vulnerability inSpryker Commerce OS 0.9 that a…8.8
• CVE-2023-27569The eo_tags package before 1.3.0 for PrestaShop allows SQL i…9.8
• CVE-2023-2757The Waiting: One-click countdowns plugin for WordPress is vu…5.4
• CVE-2023-27570The eo_tags package before 1.4.19 for PrestaShop allows SQL …9.8
• CVE-2023-27571An issue was discovered in DG3450 Cable Gateway AR01.02.056.…5.3
• CVE-2023-27572An issue was discovered in CommScope Arris DG3450 Cable Gate…6.1
• CVE-2023-27574ShadowsocksX-NG 1.10.0 signs with com.apple.security.get-tas…9.8
• CVE-2023-27576An issue was discovered in phpList before 3.6.14. Due to an …6.7
• CVE-2023-27577flarum is a forum software package for building communities.…4.9
• CVE-2023-27578Galaxy is an open-source platform for data analysis. All sup…7.5
• CVE-2023-27579TensorFlow is an end-to-end open source platform for machine…7.5
• CVE-2023-2758A denial of service vulnerability exists in Contec CONPROSYS…5.3