netbox-docker before 2.5.0 has a superuser account with default credentials (admin password for the admin account, and 0123456789abcdef0123456789abcdef01234567 …

CVE-2023-27573 affects netbox-docker versions before 2.5.0, which contains a superuser account with default credentials including an admin password and a hardcoded SUPERUSER_API_TOKEN. While nearly all users changed the default password, only about 90% changed the API token when deploying to production environments. The vulnerability was intentional for development use but became a security risk when users repurposed the product for production without changing defaults. The issue was resolved in version 2.5.0.