# nautobot (PyPI) vulnerabilities 19 known vulnerabilities (7 high, 8 medium, 4 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Weekly downloads: 17.1K - Dependents: 54 - Registry: https://pypi.org/project/nautobot/ ## Advisories (19) ### [CVE-2026-83805](https://cve.now/CVE-2026-83805): Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs - Severity: Medium 6.4 - Published: Sep 22, 2026 - Affected: from 3.0.0, fixed in 3.1.8. ### [CVE-2026-83801](https://cve.now/CVE-2026-83801): Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text - Severity: Medium 5.4 - Published: Sep 22, 2026 - Affected: fixed in 2.4.37; from 3.0.0, fixed in 3.1.8; fixed in 2.4.37; from 3.0.0, fixed in 3.1.8. ### [CVE-2026-44794](https://cve.now/CVE-2026-44794): Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference - Severity: Medium 5.4 - Published: May 28, 2026 - Affected: fixed in 2.4.33; from 3.0.0, fixed in 3.1.2; from 3.0.0a2, fixed in 3.1.2; fixed in 2.4.33. ### [CVE-2026-44796](https://cve.now/CVE-2026-44796): Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS) - Severity: Medium 6.5 - Published: May 28, 2026 - Affected: fixed in 2.4.33; from 3.0.0, fixed in 3.1.2; from 3.0.0a2, fixed in 3.1.2; fixed in 2.4.33. ### [CVE-2026-44797](https://cve.now/CVE-2026-44797): Nautobot: Webhook definitions could be used for server-side request forgery (SSRF) - Severity: High 8.5 - Published: May 28, 2026 - Affected: from 3.0.0a2, fixed in 3.1.2; fixed in 2.4.33; fixed in 2.4.33; from 3.0.0, fixed in 3.1.2. ### [CVE-2026-44798](https://cve.now/CVE-2026-44798): Nautobot: GitRepository.current\_head field should not be writable through REST API - Severity: High 7.1 - Published: May 28, 2026 - Affected: fixed in 2.4.33; from 3.0.0, fixed in 3.1.2; from 3.0.0a2, fixed in 3.1.2; fixed in 2.4.33. ### [CVE-2026-34203](https://cve.now/CVE-2026-34203): Nautobot: Management of users via REST API does not apply configured password validators - Severity: Low 2.7 - Published: Mar 31, 2026 - Affected: fixed in 2.4.30; from 3.0.0, fixed in 3.0.10; fixed in 2.4.30; from 3.0.0, fixed in 3.0.10. ### [CVE-2025-49143](https://cve.now/CVE-2025-49143): Nautobot may allows uploaded media files to be accessible without authentication - Severity: Medium 6.3 - Published: Jun 10, 2025 - Affected: fixed in 1.6.32; from 2.0.0, fixed in 2.4.10; fixed in 1.6.32; from 2.0.0, fixed in 2.4.10. ### [CVE-2025-49142](https://cve.now/CVE-2025-49142): Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating - Severity: Medium 6.0 - Published: Jun 10, 2025 - Affected: fixed in 1.6.32; from 2.0.0, fixed in 2.4.10; fixed in 1.6.32; from 2.0.0, fixed in 2.4.10. ### [CVE-2024-36112](https://cve.now/CVE-2024-36112): Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects - Severity: Medium 6.3 - Published: May 28, 2024 - Affected: from 1.3.0, fixed in 1.6.23; from 2.0.0, fixed in 2.2.5; from 2.0.0, fixed in 2.3.0b1. ### [CVE-2024-34707](https://cve.now/CVE-2024-34707): Nautobot's BANNER\_ configuration can be used to inject arbitrary HTML content into Nautobot pages - Severity: High 7.5 - Published: May 13, 2024 - Affected: fixed in 1.6.22; from 2.0.0, fixed in 2.2.4; fixed in 1.6.22; from 2.0.0, fixed in 2.2.4. ### [CVE-2024-32979](https://cve.now/CVE-2024-32979): Reflected Cross-site Scripting potential in all object list views in Nautobot - Severity: High 7.5 - Published: May 1, 2024 - Affected: from 1.5.0, fixed in 1.6.20; from 2.0.0, fixed in 2.2.3; from 1.5.0, fixed in 1.6.20; from 2.0.0, fixed in 2.2.3. ### [CVE-2024-29199](https://cve.now/CVE-2024-29199): Unauthenticated views may expose information to anonymous users - Severity: Low 3.7 - Published: Mar 26, 2024 - Affected: fixed in 1.6.16; from 2.0.0, fixed in 2.1.9; fixed in 1.6.16; from 2.0.0, fixed in 2.1.9. ### [CVE-2024-23345](https://cve.now/CVE-2024-23345): Nautobot has XSS potential in rendered Markdown fields - Severity: High 7.1 - Published: Jan 22, 2024 - Affected: from 2.0.0, fixed in 2.1.2; fixed in 1.6.10; from 2.0.0, fixed in 2.1.2; fixed in 1.6.10. ### [CVE-2023-51649](https://cve.now/CVE-2023-51649): Nautobot missing object-level permissions enforcement when running Job Buttons - Severity: Low 3.5 - Published: Dec 22, 2023 - Affected: from 1.5.14, fixed in 1.6.8; from 2.0.0, fixed in 2.1.0; from 1.5.14, fixed in 1.6.8; from 2.0.0, fixed in 2.1.0. ### [CVE-2023-50263](https://cve.now/CVE-2023-50263): Nautobot allows unauthenticated db-file-storage views - Severity: Low 3.7 - Published: Dec 12, 2023 - Affected: from 1.1.0, fixed in 1.6.7; from 2.0.0, fixed in 2.0.6; from 1.1.0, fixed in 1.6.7; from 2.0.0, fixed in 2.0.6. ### [CVE-2023-48705](https://cve.now/CVE-2023-48705): nautobot has XSS potential in custom links, job buttons, and computed fields - Severity: High 7.1 - Published: Nov 22, 2023 - Affected: from 2.0.0, fixed in 2.0.5; fixed in 1.6.6; fixed in 1.6.6; from 2.0.0, fixed in 2.0.5. ### [CVE-2023-46128](https://cve.now/CVE-2023-46128): Exposure of hashed user passwords via REST API in Nautobot - Severity: Medium 6.5 - Published: Oct 24, 2023 - Affected: from 2.0.0, fixed in 2.0.3. ### [CVE-2023-25657](https://cve.now/CVE-2023-25657): Remote code execution in Jinja2 template rendering in Nautobot - Severity: High 7.5 - Published: Feb 21, 2023 - Affected: fixed in 1.5.7; fixed in 1.5.7. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/nautobot Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.