Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

nautobot

19 known vulnerabilities (7 high, 8 medium, 4 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
19 · 7 high, 8 medium, 4 low
Weekly downloads
17.1K
Dependents
54
Registry
PyPI

Advisories 19

  • CVE-2026-83805Medium 6.4

    Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs

    Affected: from 3.0.0, fixed in 3.1.8.

  • CVE-2026-83801Medium 5.4

    Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

    Affected: fixed in 2.4.37; from 3.0.0, fixed in 3.1.8; fixed in 2.4.37; from 3.0.0, fixed in 3.1.8.

  • CVE-2026-44794Medium 5.4

    Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference

    Affected: fixed in 2.4.33; from 3.0.0, fixed in 3.1.2; from 3.0.0a2, fixed in 3.1.2; fixed in 2.4.33.

  • CVE-2026-44796Medium 6.5

    Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)

    Affected: fixed in 2.4.33; from 3.0.0, fixed in 3.1.2; from 3.0.0a2, fixed in 3.1.2; fixed in 2.4.33.

  • Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)

    Affected: from 3.0.0a2, fixed in 3.1.2; fixed in 2.4.33; fixed in 2.4.33; from 3.0.0, fixed in 3.1.2.

  • Nautobot: GitRepository.current_head field should not be writable through REST API

    Affected: fixed in 2.4.33; from 3.0.0, fixed in 3.1.2; from 3.0.0a2, fixed in 3.1.2; fixed in 2.4.33.

  • Nautobot: Management of users via REST API does not apply configured password validators

    Affected: fixed in 2.4.30; from 3.0.0, fixed in 3.0.10; fixed in 2.4.30; from 3.0.0, fixed in 3.0.10.

  • CVE-2025-49143Medium 6.3

    Nautobot may allows uploaded media files to be accessible without authentication

    Affected: fixed in 1.6.32; from 2.0.0, fixed in 2.4.10; fixed in 1.6.32; from 2.0.0, fixed in 2.4.10.

  • CVE-2025-49142Medium 6.0

    Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating

    Affected: fixed in 1.6.32; from 2.0.0, fixed in 2.4.10; fixed in 1.6.32; from 2.0.0, fixed in 2.4.10.

  • CVE-2024-36112Medium 6.3

    Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects

    Affected: from 1.3.0, fixed in 1.6.23; from 2.0.0, fixed in 2.2.5; from 2.0.0, fixed in 2.3.0b1.

  • Nautobot's BANNER_ configuration can be used to inject arbitrary HTML content into Nautobot pages

    Affected: fixed in 1.6.22; from 2.0.0, fixed in 2.2.4; fixed in 1.6.22; from 2.0.0, fixed in 2.2.4.

  • Reflected Cross-site Scripting potential in all object list views in Nautobot

    Affected: from 1.5.0, fixed in 1.6.20; from 2.0.0, fixed in 2.2.3; from 1.5.0, fixed in 1.6.20; from 2.0.0, fixed in 2.2.3.

  • Unauthenticated views may expose information to anonymous users

    Affected: fixed in 1.6.16; from 2.0.0, fixed in 2.1.9; fixed in 1.6.16; from 2.0.0, fixed in 2.1.9.

  • Nautobot has XSS potential in rendered Markdown fields

    Affected: from 2.0.0, fixed in 2.1.2; fixed in 1.6.10; from 2.0.0, fixed in 2.1.2; fixed in 1.6.10.

  • Nautobot missing object-level permissions enforcement when running Job Buttons

    Affected: from 1.5.14, fixed in 1.6.8; from 2.0.0, fixed in 2.1.0; from 1.5.14, fixed in 1.6.8; from 2.0.0, fixed in 2.1.0.

Show all 19 advisoriesShow fewer advisories

  • Nautobot allows unauthenticated db-file-storage views

    Affected: from 1.1.0, fixed in 1.6.7; from 2.0.0, fixed in 2.0.6; from 1.1.0, fixed in 1.6.7; from 2.0.0, fixed in 2.0.6.

  • nautobot has XSS potential in custom links, job buttons, and computed fields

    Affected: from 2.0.0, fixed in 2.0.5; fixed in 1.6.6; fixed in 1.6.6; from 2.0.0, fixed in 2.0.5.

  • CVE-2023-46128Medium 6.5

    Exposure of hashed user passwords via REST API in Nautobot

    Affected: from 2.0.0, fixed in 2.0.3.

  • Remote code execution in Jinja2 template rendering in Nautobot

    Affected: fixed in 1.5.7; fixed in 1.5.7.