Every CVE Search/ Get API key

CVE-2025-49142

Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating

6.0 MediumFix available

CVE-2025-49142 is a medium vulnerability (CVSS 6.0) in Nautobot, published June 10, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in nautobot 1.6.32.

Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot, a malicious user could configure this feature set in ways that could expose the value of Secrets defined in Nautobot when the templated content is rendered or that could call Python APIs to modify data within Nautobot when the templated content is rendered, bypassing the object permissions assigned to the viewing user. Nautobot versions 1.6.32 and 2.4.10 will include fixes for the vulnerability. The vulnerability can be partially mitigated by configuring object permissions appropriately to limit certain actions to only trusted users.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
Low
Availability
None

Exploit likelihood

0.37%Up 0.3 points since Jun 11, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.0

Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating

Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot, a malicious user could configure this feature set in ways that could expose the value of Secrets defined in Nautobot when the templated content is rendered or that could call Python APIs to modify data within Nautobot when the templated content is rendered, bypassing the object permissions assigned to the viewing user. Nautobot versions 1.6.32 and 2.4.10 will include fixes for the vulnerability. The vulnerability can be partially mitigated by configuring object permissions appropriately to limit certain actions to only trusted users.

Record
CVE-2025-49142
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:L
Weakness
CWE-1336
Updated
2026-11-02
EUVDEUVD-2025-17714 6.0

Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot, a malicious user could configure this feature set in ways that could expose the value of Secrets defined in Nautobot when the templated content is rendered or that could call Python APIs to modify data within Nautobot when the templated content is rendered, bypassing the object permissions assigned to the viewing user. Nautobot versions 1.6.32 and 2.4.10 will include fixes for the vulnerability. The vulnerability can be partially mitigated by configuring object permissions appropriately to limit certain actions to only trusted users.

Record
EUVD-2025-17714
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-wjw6-95h5-4jpx 6.0

Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating

Impact

What kind of vulnerability is it? Who is impacted?

All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected.

Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot:

  1. A malicious user could configure this feature set in ways that could expose the value of Secrets defined in Nautobot when the templated content is rendered.
  2. A malicious user could configure this feature set in ways that could call Python APIs to modify data within Nautobot when the templated content is rendered, bypassing the object permissions assigned to the viewing user.

Patches

Has the problem been patched? What versions should users upgrade to?

Nautobot versions 1.6.32 and 2.4.10 will include fixes for the vulnerability.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

The vulnerability can be partially mitigated by configuring object permissions appropriately to limit the below actions to only trusted users:

  • extras.add_secret
  • extras.change_secret
  • extras.view_secret
  • extras.add_computedfield
  • extras.change_computedfield
  • extras.add_customlink
  • extras.change_customlink
  • extras.add_jobbutton
  • extras.change_jobbutton

References

Are there any links users can visit to find out more?

Record
GHSA-wjw6-95h5-4jpx
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:L
Weakness
CWE-1336
Updated
2026-11-02
NVD 6.0

Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot, a malicious user could configure this feature set in ways that could expose the value of Secrets defined in Nautobot when the templated content is rendered or that could call Python APIs to modify data within Nautobot when the templated content is rendered, bypassing the object permissions assigned to the viewing user. Nautobot versions 1.6.32 and 2.4.10 will include fixes for the vulnerability. The vulnerability can be partially mitigated by configuring object permissions appropriately to limit certain actions to only trusted users.

Record
CVE-2025-49142
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Weakness
CWE-1336
Updated
2026-11-02
OSV 6.0

Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating

Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot, a malicious user could configure this feature set in ways that could expose the value of Secrets defined in Nautobot when the templated content is rendered or that could call Python APIs to modify data within Nautobot when the templated content is rendered, bypassing the object permissions assigned to the viewing user. Nautobot versions 1.6.32 and 2.4.10 will include fixes for the vulnerability. The vulnerability can be partially mitigated by configuring object permissions appropriately to limit certain actions to only trusted users.

Record
CVE-2025-49142
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:L
Weakness
CWE-1336
Updated
2026-11-02
OSVGHSA-wjw6-95h5-4jpx 6.0

Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating

Impact

What kind of vulnerability is it? Who is impacted?

All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected.

Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot:

  1. A malicious user could configure this feature set in ways that could expose the value of Secrets defined in Nautobot when the templated content is rendered.
  2. A malicious user could configure this feature set in ways that could call Python APIs to modify data within Nautobot when the templated content is rendered, bypassing the object permissions assigned to the viewing user.

Patches

Has the problem been patched? What versions should users upgrade to?

Nautobot versions 1.6.32 and 2.4.10 will include fixes for the vulnerability.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

The vulnerability can be partially mitigated by configuring object permissions appropriately to limit the below actions to only trusted users:

  • extras.add_secret
  • extras.change_secret
  • extras.view_secret
  • extras.add_computedfield
  • extras.change_computedfield
  • extras.add_customlink
  • extras.change_customlink
  • extras.add_jobbutton
  • extras.change_jobbutton

References

Are there any links users can visit to find out more?

Record
GHSA-wjw6-95h5-4jpx
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:L
Weakness
CWE-1336
Updated
2026-11-02
OSVPYSEC-2025-74 7.1

Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot, a malicious user could configure this feature set in ways that could expose the value of Secrets defined in Nautobot when the templated content is rendered or that could call Python APIs to modify data within Nautobot when the templated content is rendered, bypassing the object permissions assigned to the viewing user. Nautobot versions 1.6.32 and 2.4.10 will include fixes for the vulnerability. The vulnerability can be partially mitigated by configuring object permissions appropriately to limit certain actions to only trusted users.

Record
PYSEC-2025-74
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVPYSEC-2025-79 7.1

Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot, a malicious user could configure this feature set in ways that could expose the value of Secrets defined in Nautobot when the templated content is rendered or that could call Python APIs to modify data within Nautobot when the templated content is rendered, bypassing the object permissions assigned to the viewing user. Nautobot versions 1.6.32 and 2.4.10 will include fixes for the vulnerability. The vulnerability can be partially mitigated by configuring object permissions appropriately to limit certain actions to only trusted users.

Record
PYSEC-2025-79
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nautobot
PyPI
 before 1.6.32
1.6.32
nautobot
PyPI
 2.0.0 up to 2.4.10
2.4.10
nautobot
PyPI
 before 1.6.32, plus listed versions
1.0.01.0.0a11.0.0a21.0.0b11.0.0b2
Show 45 moreShow less
1.0.0b31.0.0b41.0.11.0.21.0.31.1.01.1.11.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.101.2.111.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.3.01.3.11.3.101.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.91.4.01.4.11.4.101.4.21.4.31.4.41.4.51.4.71.4.81.4.9
1.6.32
nautobot
PyPI
 2.0.0 up to 2.4.10, plus listed versions
2.0.12.0.22.0.32.0.42.0.5
Show 45 moreShow less
2.0.62.1.02.1.0b12.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.0b12.2.12.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.0b12.3.12.3.102.3.112.3.122.3.132.3.142.3.152.3.15b12.3.162.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.0b12.4.1
2.4.10
nautobot
PyPI
 before 1.6.32, 2.0.0 up to 2.4.10, plus listed versions
1.0.01.0.0a11.0.0a21.0.0b11.0.0b2
Show 45 moreShow less
1.0.0b31.0.0b41.0.11.0.21.0.31.1.01.1.11.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.101.2.111.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.3.01.3.11.3.101.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.91.4.01.4.11.4.101.4.21.4.31.4.41.4.51.4.71.4.81.4.9
1.6.322.4.10

History

History
WhenChangedSources
2026-11-03affected
2026-11-02createdCVE List, EUVD, GitHub Advisories, NVD, OSV

References

Show 5 moreShow less
This page doesn't list everything

Left out here: 180 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open