Add a Sandbox security consideration to warn of unfettered DB access. #1233

New Issue

MrUnknownDE · 2026-04-05T22:24:07+02:00

MrUnknownDE commented

2026-04-05 22:24:07 +02:00

Originally created by @jchambers2012 on 9/16/2025

Change Type

Addition

Area

Administration

Proposed Changes

Add a warning to the documentation letting administrators know that the Jinja subsystem near full read only access to the database’s models and could allow for retrieving secrets for core and plugin and edit access to templates should only be extended to trusted administrators.
Add a new section to docs/administration/permissions.md with a section for Jinja Sandbox Warning with some kind of warning like:

Individual user permissions are NOT enforced within the NetBox Jinja Sandbox for exposed models. Only trust administrators should have edit rights to update an object and any synced template files should only come from a trusted source with similar permissions or change controls. This can potently expose cross-user/tenants information such as site and devices configurations or secrets.

A banner could be added to Configuration Templates model linking to this new section. This banner may also then be added to more models that use the sandbox such as Export Templates, Custom Links and Web Hooks that might have the potential to expose secrets via database models if testing detriments a risk might exist.

The Sandbox Template Engine has additional security considerations, please see: LINK

This has been verified by testing with a configuration template (that has access to all models) pulling a full list of un-truncated User Token and pulling all username and password from Data Source from a read only account that is limited to DCIM object only in 4.3.7

*Originally created by @jchambers2012 on 9/16/2025* ### Change Type Addition ### Area Administration ### Proposed Changes Add a warning to the documentation letting administrators know that the Jinja subsystem near full read only access to the database’s models and could allow for retrieving secrets for core and plugin and edit access to templates should only be extended to trusted administrators. Add a new section to docs/administration/permissions.md with a section for Jinja Sandbox Warning with some kind of warning like: >Individual user permissions are NOT enforced within the NetBox Jinja Sandbox for exposed models. Only trust administrators should have edit rights to update an object and any synced template files should only come from a trusted source with similar permissions or change controls. This can potently expose cross-user/tenants information such as site and devices configurations or secrets. A banner could be added to Configuration Templates model linking to this new section. This banner may also then be added to more models that use the sandbox such as Export Templates, Custom Links and Web Hooks that might have the potential to expose secrets via database models if testing detriments a risk might exist. >The Sandbox Template Engine has additional security considerations, please see: LINK This has been verified by testing with a configuration template (that has access to all models) pulling a full list of un-truncated User Token and pulling all username and password from Data Source from a read only account that is limited to DCIM object only in 4.3.7

MrUnknownDE closed this issue

2026-04-05 22:24:07 +02:00

Sign in to join this conversation.

Branches Tags

main

21455-sql-indexes-audit

21357-register-model-actions

feature

20924-plugin-ui-components

21766-improve-test-coverage-for-sortable-table-columns

21157-export-template-public-models

21025-pre-render-config-contexts

21364-swagger

feature-ip-prefix-link

20911-dropdown-3

fix_module_substitution

21160-filterset

20911-dropdown-2

20044-elevation-stuck-lightmode

7604-filter-modifiers-v3

20660-script-load

19724-graphql

14884-script

19720-macaddress-interface-generic-relation

fix-19669-api-image-download

7604-filter-modifiers

19275-fixes-interface-bulk-edit

fix-17794-get_field_value_return_list

11507-show-aggregate-and-rir-on-api

9583-add_column_specific_search_field_to_tables

No Label netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure pending closure status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner status: needs owner type: documentation type: documentation type: documentation type: documentation type: documentation type: documentation type: documentation type: documentation type: documentation type: documentation type: documentation type: documentation type: documentation type: documentation type: documentation type: documentation type: documentation type: documentation type: documentation type: documentation type: documentation type: documentation type: documentation type: documentation type: documentation

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/netbox#1233