CVE-2023-27573 is a critical (9.0) default credentials issue in netbox-docker before 2.5.0. The image shipped a superuser with a known password and a fixed API token. Upgrade to 2.5.0 or later, and change the password and the API token on any instance that is reachable from an untrusted network.
What's affected
The record lists netbox-docker before 2.5.0. The record says the superuser account used the password admin and a fixed, publicly documented API token value. It notes that most operators changed the password but only about 90 percent changed the token.
The default token was intentional for isolated development use, which was the main purpose of the project. The record explains that some users repurposed the project for production, and the documentation told them not to use the defaults, but installation did not enforce changes.
The fix is in release 2.5.0. The release notes say a default admin account is no longer created, and that the release requires NetBox 3.4.x or later. The notes I read do not describe the token change in detail, so read the linked pull request and the project documentation for how to create your own superuser and token.
How to check if you're exposed
Find out how your NetBox was deployed.
docker ps --format "table {{.Names}}\t{{.Image}}"
docker compose config | grep -i -E "SUPERUSER|image:"
- If you deployed from the netbox-docker repository, check the tag or release you are running and whether it is older than 2.5.0.
- Check the environment for SUPERUSER_API_TOKEN. If it is unset or equals the default value shown in the project issue, treat it as compromised.
- In the NetBox admin, list API tokens and delete any you do not recognize.
- Check whether the NetBox API is reachable from the internet.
What to do now
- Upgrade netbox-docker to 2.5.0 or later, reading the release notes first.
- Create a named superuser with a strong password, and make sure no account still uses the default password.
- Delete the default API token and generate new ones. Store them in a secrets manager, not in the compose file.
- Restrict the NetBox web and API ports to your management network.
- Audit changes in NetBox for edits you did not make, since the data describes your network and may feed automation.
Why it matters
The record lists CWE-1392, use of default credentials, and CWE-798, use of hard coded credentials. A known secret is not a vulnerability in a single line of code, it is a decision that was safe in one setting and unsafe in another. Development defaults leak into production because nothing forces them to change.
NetBox often holds the source of truth for network addresses, devices and circuits. Write access to it can feed automation that changes real infrastructure. That is why a default token on an exposed instance is rated so high, even though the attack complexity is marked high in the vector.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is changing the password enough?
No. The record says many users changed the password but kept the default API token. Replace both.
Sources
- netbox-docker 2.5.0 release notes
- Project issue 953 referenced by the record
- Project pull request 959 referenced by the record
Last reviewed: 19 October 2026.
