A superuser account is created in netbox-docker containers before version 2.5.0 with a fixed administrator password and a documented default API token (0123456789abcdef0123456789abcdef01234567). These credentials are usable over the network and therefore expose the system to full administrative control. The weakness is a credential disclosure (CWE‑798) and the presence of a hard‑coded secret represents a misuse of a fixed value (CWE‑1392).

All releases of netbox-community:netbox-docker issued before 2.5.0 contain the insecure default credentials. The product’s documentation recommends changing these defaults, but the deployment does not enforce it, leaving the network exposed if the image is run unchanged.

The vulnerability carries a CVSS score of 9, categorized as critical. Its EPSS score is below 1 % and it is not listed in the CISA KEV catalog. An attacker only needs remote access to the containerized instance and the known default credentials, with no additional privileges required. While the likelihood of exploitation is considered low, the potential for complete administrative takeover warrants immediate action.