Nautobot vulnerabilities

Products

• Nautobot 19

Newest

• nautobot Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs CVE-2026-83805 Fix available 6.4 MediumSeptember 22, 2026
• nautobot Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text CVE-2026-83801 Fix available 5.4 MediumSeptember 22, 2026
• nautobot Nautobot: GitRepository.current_head field should not be writable through REST API CVE-2026-44798 Fix available 7.1 HighMay 13, 2026
• nautobot Nautobot: Webhook definitions could be used for server-side request forgery (SSRF) CVE-2026-44797 Fix available 8.5 HighMay 13, 2026
• nautobot Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS) CVE-2026-44796 Fix available 6.5 MediumMay 13, 2026
• nautobot Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference CVE-2026-44794 Fix available 5.4 MediumMay 13, 2026
• nautobot Nautobot: Management of users via REST API does not apply configured password validators CVE-2026-34203 Fix available 2.7 LowMarch 31, 2026
• nautobot nautobot-app-ssot Nautobot Single Source of Truth (SSoT) has an unauthenticated ServiceNow configuration URL CVE-2025-62607 Fix available 5.3 MediumOctober 21, 2025
• nautobot Nautobot may allows uploaded media files to be accessible without authentication CVE-2025-49143 Fix available 6.3 MediumJune 10, 2025
• nautobot Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating CVE-2025-49142 Fix available 6.0 MediumJune 10, 2025
• nautobot Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects CVE-2024-36112 Fix available 6.3 MediumMay 28, 2024
• nautobot Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages CVE-2024-34707 Fix available 7.5 HighMay 13, 2024
• nautobot Reflected Cross-site Scripting potential in all object list views in Nautobot CVE-2024-32979 Fix available 7.5 HighMay 1, 2024
• nautobot Unauthenticated views may expose information to anonymous users CVE-2024-29199 Fix available 3.7 LowMarch 26, 2024
• nautobot Nautobot has XSS potential in rendered Markdown fields CVE-2024-23345 Fix available 7.1 HighJanuary 22, 2024
• nautobot Nautobot missing object-level permissions enforcement when running Job Buttons CVE-2023-51649 Fix available 3.5 LowDecember 22, 2023
• nautobot Nautobot allows unauthenticated db-file-storage views CVE-2023-50263 Fix available 3.7 LowDecember 12, 2023
• nautobot nautobot has XSS potential in custom links, job buttons, and computed fields CVE-2023-48705 Fix available 7.1 HighNovember 22, 2023
• nautobot nautobot-plugin-device-onboarding Clear Text Credentials Exposed via Onboarding Task CVE-2023-48700 Fix available 5.7 MediumNovember 21, 2023
• nautobot Exposure of hashed user passwords via REST API in Nautobot CVE-2023-46128 Fix available 6.5 MediumOctober 24, 2023
• nautobot Remote code execution in Jinja2 template rendering in Nautobot CVE-2023-25657 Fix available 7.5 HighFebruary 21, 2023