nautobot

Network Source of Truth & Network Automation Platform

View on Pypi

View on Github

Activity

Latest release: 2w ago
Total releases: 236
Cadence: ~4 days
Last 12 months: 59

Reach

Stars: 1.6k

Details

License: Apache-2.0
First release: Feb 24, 2021

Releases

Version	Released
`3.2.4` patch	Aug 31, 2026
`2.4.41` patch	Aug 31, 2026
`2.4.40` patch	Aug 17, 2026
`3.2.3` patch	Aug 17, 2026
`3.2.2` patch	Aug 03, 2026
`2.4.39` patch	Aug 03, 2026
`3.2.1` patch	Jul 28, 2026
`3.2.0` minor	Jul 27, 2026
`2.4.38` patch	Jul 27, 2026
`3.2.0b2` pre	Jul 23, 2026
`2.4.37` patch	Jul 17, 2026
`3.1.8` patch	Jul 17, 2026
`3.2.0b1` pre	Jul 09, 2026
`3.1.7` patch	Jul 06, 2026
`3.1.6` patch	Jun 23, 2026
`2.4.36` patch	Jun 22, 2026
`3.1.5` patch	Jun 22, 2026
`2.4.35` patch	Jun 08, 2026
`3.1.4` patch	Jun 08, 2026
`2.4.34` patch	May 26, 2026
`3.1.3` patch	May 26, 2026
`2.4.33` patch	May 08, 2026
`3.1.2` patch	May 08, 2026
`2.4.32` patch 4 CVEs	Apr 27, 2026
`3.1.1` patch 4 CVEs	Apr 27, 2026
`3.1.0` minor 4 CVEs	Apr 14, 2026
`2.4.31` patch 4 CVEs	Apr 09, 2026
`3.0.11` patch 4 CVEs	Apr 08, 2026
`3.1.0a5` pre 4 CVEs	Apr 07, 2026
`3.1.0a4` pre 4 CVEs	Apr 02, 2026
`2.4.30` patch 4 CVEs	Mar 31, 2026
`3.0.10` patch 4 CVEs	Mar 30, 2026
`2.4.29` patch 5 CVEs	Mar 17, 2026
`3.0.9` patch 5 CVEs	Mar 17, 2026
`2.4.28` patch 5 CVEs	Mar 02, 2026
`3.0.8` patch 5 CVEs	Mar 02, 2026
`3.1.0a3` pre 4 CVEs	Feb 25, 2026
`2.4.27` patch 5 CVEs	Feb 17, 2026
`3.0.7` patch 5 CVEs	Feb 17, 2026
`3.1.0a2` pre 4 CVEs	Feb 11, 2026
`3.1.0a1` pre 4 CVEs	Feb 10, 2026
`2.4.26` patch 5 CVEs	Feb 02, 2026
`3.0.6` patch 5 CVEs	Feb 02, 2026
`3.0.5` patch 5 CVEs	Jan 19, 2026
`3.0.4` patch 5 CVEs	Jan 12, 2026
`2.4.25` patch 5 CVEs	Jan 09, 2026
`3.0.3` patch 5 CVEs	Dec 22, 2025
`2.4.24` patch 5 CVEs	Dec 15, 2025
`3.0.2` patch 5 CVEs	Dec 08, 2025
`2.4.23` patch 5 CVEs	Nov 25, 2025

1–50 of 236

Repository

nautobot/nautobot

Forks: 415
Open issues: 947
Language: Python
: 6.7/ 10

nautobot
python
network-automation
ipam
dcim
sot

Dependencies (62)

Depends on

3.2.4

Used by

Supply-chain exposure

87 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (17)

CVE-2025-49143 PYSEC-2026-1689 GHSA-rh67-4c8j-hjjh Jul 07, 2026

Nautobot may allows uploaded media files to be accessible without authentication

Medium
Network High None None

Impact

Files uploaded by users to Nautobot's MEDIA_ROOT directory, including DeviceType image attachments as well as images attached to a Location, Device, or Rack, are served to users via a URL endpoint that was not enforcing user authentication. As a consequence, such files can be retrieved by anonymous users who know or can guess the correct URL for a given file.

For DeviceType image attachments, a mitigating factor is that no URL endpoint exists for listing the contents of the devicetype-images/ subdirectory, and the file names are as specified by the uploading user, so any given DeviceType image attachment can only be retrieved by correctly guessing its file name.

Similarly, for all other image attachments, while the images can be listed by accessing the /api/extras/image-attachments/ endpoint as an authenticated user only, absent that authenticated access, accessing the files would again require guessing file names correctly.

Patches

Nautobot v2.4.10 and v1.6.32 will address this issue by adding enforcement of Nautobot user authentication to this endpoint.

Workarounds

No workaround other than applying the patch given in https://github.com/nautobot/nautobot/pull/6672 (2.x) or https://github.com/nautobot/nautobot/pull/6703 (1.6)

References

Are there any links users can visit to find out more?

https://github.com/nautobot/nautobot/commit/9c892dc300429948a4714f743c9c2879d8987340

https://github.com/nautobot/nautobot/commit/d99a53b065129cff3a0fa9abe7355a9ef1ad4c95

Affected versions

1.0.01.0.0a11.0.0a21.0.0b11.0.0b21.0.0b31.0.0b41.0.11.0.21.0.31.1.01.1.1

+ 154 more Show less

1.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.101.2.111.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.3.01.3.11.3.101.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.91.4.01.4.11.4.101.4.21.4.31.4.41.4.51.4.71.4.81.4.91.5.01.5.11.5.101.5.111.5.121.5.131.5.141.5.151.5.161.5.171.5.181.5.191.5.21.5.201.5.211.5.221.5.231.5.241.5.31.5.41.5.51.5.61.5.71.5.81.5.91.6.01.6.11.6.101.6.111.6.121.6.131.6.141.6.151.6.161.6.171.6.181.6.191.6.21.6.201.6.211.6.221.6.231.6.241.6.251.6.261.6.271.6.281.6.291.6.31.6.301.6.311.6.41.6.51.6.61.6.71.6.81.6.92.0.02.0.12.0.22.0.32.0.42.0.52.0.62.1.02.1.0b12.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.0b12.2.12.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.0b12.3.12.3.102.3.112.3.122.3.132.3.142.3.152.3.15b12.3.162.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.0b12.4.12.4.22.4.32.4.42.4.52.4.62.4.72.4.82.4.9

Fixed in

1.6.322.4.10

References

https://github.com/nautobot/nautobot/security/advisories/GHSA-rh67-4c8j-hjjh
https://nvd.nist.gov/vuln/detail/CVE-2025-49143
https://github.com/nautobot/nautobot/pull/6672
https://github.com/nautobot/nautobot/pull/6703
https://github.com/nautobot/nautobot/commit/9c892dc300429948a4714f743c9c2879d8987340
https://github.com/nautobot/nautobot/commit/d99a53b065129cff3a0fa9abe7355a9ef1ad4c95

Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-34707 PYSEC-2026-1688 GHSA-r2hr-4v48-fjv3 Jul 07, 2026

Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages

7.5 / 10
High
Network Low High Required Changed Low High Low

Impact

A Nautobot user with admin privileges can modify the BANNER_TOP, BANNER_BOTTOM, and BANNER_LOGIN configuration settings via the /admin/constance/config/ endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of BANNER_LOGIN) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS).

Patches

Has the problem been patched? What versions should users upgrade to?

Patches will be released as part of Nautobot 1.6.22 and 2.2.4.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

As described in the Nautobot documentation, these settings are only configurable through the admin UI of Nautobot if they are not explicitly set to some non-empty value in the nautobot_config.py or equivalent Nautobot configuration file. Therefore, adding the following configuration to said file completely mitigates this vulnerability in both Nautobot 1.x and 2.x:

BANNER_LOGIN = " " BANNER_TOP = " " BANNER_BOTTOM = " "

or alternately (Nautobot 2.x only), if those variables are not defined explicitly in your configuration file, setting the following environment variables for the Nautobot user account serves the same purpose:

NAUTOBOT_BANNER_LOGIN=" " NAUTOBOT_BANNER_TOP=" " NAUTOBOT_BANNER_BOTTOM=" "

Limiting all users who do not need elevated privileges to non-admin access (is_superuser: False and is_staff: False) is a partial mitigation as well.

References

https://github.com/nautobot/nautobot/pull/5697

https://github.com/nautobot/nautobot/pull/5698

Affected versions

1.0.01.0.0a11.0.0a21.0.0b11.0.0b21.0.0b31.0.0b41.0.11.0.21.0.31.1.01.1.1

+ 108 more Show less

1.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.101.2.111.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.3.01.3.11.3.101.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.91.4.01.4.11.4.101.4.21.4.31.4.41.4.51.4.71.4.81.4.91.5.01.5.11.5.101.5.111.5.121.5.131.5.141.5.151.5.161.5.171.5.181.5.191.5.21.5.201.5.211.5.221.5.231.5.241.5.31.5.41.5.51.5.61.5.71.5.81.5.91.6.01.6.11.6.101.6.111.6.121.6.131.6.141.6.151.6.161.6.171.6.181.6.191.6.21.6.201.6.211.6.31.6.41.6.51.6.61.6.71.6.81.6.92.0.02.0.12.0.22.0.32.0.42.0.52.0.62.1.02.1.0b12.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.0b12.2.12.2.22.2.3

Fixed in

1.6.222.2.4

References

https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3
https://nvd.nist.gov/vuln/detail/CVE-2024-34707
https://github.com/nautobot/nautobot/pull/5697
https://github.com/nautobot/nautobot/pull/5698
https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c
https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423

Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-32979 PYSEC-2026-1686 GHSA-jxgr-gcj5-cqqg Jul 07, 2026

nautobot has reflected Cross-site Scripting potential in all object list views

7.5 / 10
High
Network High None Required Changed Low High Low

Impact

It was discovered that due to improper handling and escaping of user-provided query parameters, a maliciously crafted Nautobot URL could potentially be used to execute a Reflected Cross-Site Scripting (Reflected XSS) attack against users. All filterable object-list views in Nautobot are vulnerable, including:

/dcim/location-types/

/dcim/locations/

/dcim/racks/

/dcim/rack-groups/

/dcim/rack-reservations/

/dcim/rack-elevations/

/tenancy/tenants/

/tenancy/tenant-groups/

/extras/tags/

/extras/statuses/

/extras/roles/

/extras/dynamic-groups/

/dcim/devices/

/dcim/platforms/

/dcim/virtual-chassis/

/dcim/device-redundancy-groups/

/dcim/interface-redundancy-groups/

/dcim/device-types/

/dcim/manufacturers/

/dcim/cables/

/dcim/console-connections/

/dcim/power-connections/

/dcim/interface-connections/

/dcim/interfaces/

/dcim/front-ports/

/dcim/rear-ports/

/dcim/console-ports/

/dcim/console-server-ports/

/dcim/power-ports/

/dcim/power-outlets/

/dcim/device-bays/

/dcim/inventory-items/

/ipam/ip-addresses/

/ipam/prefixes

/ipam/rirs/

/ipam/namespaces/

/ipam/vrfs/

/ipam/route-targets/

/ipam/vlans/

/ipam/vlan-groups/

/ipam/services/

/virtualization/virtual-machines/

/virtualization/interfaces/

/virtualization/clusters/

/virtualization/cluster-types/

/virtualization/cluster-groups/

/circuits/circuits/

/circuits/circuit-types/

/circuits/providers/

/circuits/provider-networks/

/dcim/power-feeds/

/dcim/power-panels/

/extras/secrets/

/extras/secrets-groups/

/extras/jobs/

/extras/jobs/scheduled-jobs/approval-queue/

/extras/jobs/scheduled-jobs/

/extras/job-results/

/extras/job-hooks/

/extras/job-buttons/

/extras/object-changes/

/extras/git-repositories/

/extras/graphql-queries/

/extras/relationships/

/extras/notes/

/extras/config-contexts/

/extras/config-context-schemas/

/extras/export-templates/

/extras/external-integrations/

/extras/webhooks/

/extras/computed-fields/

/extras/custom-fields/

/extras/custom-links/

as well as any similar object-list views provided by any Nautobot App.

Patches

Fixed in Nautobot 1.6.20 and 2.2.3.

Workarounds

No workaround has been identified

References

#5646

#5647

Credit to Michael Panorios for reporting this issue.

Affected versions

1.5.01.5.11.5.101.5.111.5.121.5.131.5.141.5.151.5.161.5.171.5.181.5.19

+ 55 more Show less

1.5.21.5.201.5.211.5.221.5.231.5.241.5.31.5.41.5.51.5.61.5.71.5.81.5.91.6.01.6.11.6.101.6.111.6.121.6.131.6.141.6.151.6.161.6.171.6.181.6.191.6.21.6.31.6.41.6.51.6.61.6.71.6.81.6.92.0.02.0.12.0.22.0.32.0.42.0.52.0.62.1.02.1.0b12.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.0b12.2.12.2.2

Fixed in

1.6.202.2.3

References

https://github.com/nautobot/nautobot/security/advisories/GHSA-jxgr-gcj5-cqqg
https://nvd.nist.gov/vuln/detail/CVE-2024-32979
https://github.com/nautobot/nautobot/pull/5646
https://github.com/nautobot/nautobot/pull/5647
https://github.com/nautobot/nautobot/commit/2ea5797ea43646d5d8b29433e4c707b5a9758146
https://github.com/nautobot/nautobot/commit/42440ebd9b381534ad89d62420ebea00d703d64e

Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-29199 PYSEC-2026-1687 GHSA-m732-wvh2-7cq4 Jul 07, 2026

Unauthenticated views may expose information to anonymous users

3.7 / 10
Low
Network High None None Unchanged Low None None

Impact

A number of Nautobot URL endpoints were found to be improperly accessible to unauthenticated (anonymous) users, including the following:

/api/graphql/ (1)

/api/users/users/session/ (Nautobot 2.x only; the only information exposed to an anonymous user is which authentication backend classes are enabled on this Nautobot instance)

/dcim/racks/<uuid:pk>/dynamic-groups/ (1)

/dcim/devices/<uuid:pk>/dynamic-groups/ (1)

/extras/job-results/<uuid:pk>/log-table/

/extras/secrets/provider/<str:provider_slug>/form/ (the only information exposed to an anonymous user is the fact that a secrets provider with the given slug (e.g. environment-variable or text-file) is supported by this Nautobot instance)

/ipam/prefixes/<uuid:pk>/dynamic-groups/ (1)

/ipam/ip-addresses/<uuid:pk>/dynamic-groups/ (1)

/virtualization/clusters/<uuid:pk>/dynamic-groups/ (1)

/virtualization/virtual-machines/<uuid:pk>/dynamic-groups/ (1)

(1) These endpoints will not disclose any Nautobot data to an unauthenticated user unless the Nautobot configuration variable EXEMPT_VIEW_PERMISSIONS is changed from its default value (an empty list) to permit access to specific data by unauthenticated users.

Of these endpoints, the only one that poses any significant risk of sensitive information disclosure under normal Nautobot operation with a default configuration is /extras/job-results/<uuid:pk>/log-table/. This endpoint returns an HTML table containing all of the logs associated with the specified JobResult; while these logs may contain sensitive information depending on the Jobs executed in Nautobot, this exposure is mitigated somewhat by the fact that any attacker would have to have prior knowledge of the existence of a JobResult with a particular UUID.

In the interest of full disclosure, the following additional endpoints were also accessible to anonymous users, but do not disclose any sensitive data when accessed (only a listing of other API endpoints).

/api/

/api/circuits/

/api/dcim/

/api/extras/

/api/ipam/

/api/plugins/

/api/tenancy/

/api/users/

/api/virtualization/

All of the above endpoints have been corrected to require user authentication, with the exception of /api/users/users/session/ which is unused at this time and therefore has been simply removed from Nautobot 2.1.9. Additionally, we have added test automation which enumerates available Nautobot URL endpoints and verifies that appropriate authentication requirements are in place; this test was instrumental in identifying the above comprehensive list.

Patches

Fixes will be included in Nautobot 1.6.16 and 2.1.9.

Workarounds

Partial workaround: If your configuration includes a non-default value for EXEMPT_VIEW_PERMISSIONS (the Nautobot default is an empty list), reverting it to default will prevent exposure of Nautobot information to unauthenticated users via the endpoints marked with (1) above.

References

Are there any links users can visit to find out more?

Affected versions

1.0.01.0.0a11.0.0a21.0.0b11.0.0b21.0.0b31.0.0b41.0.11.0.21.0.31.1.01.1.1

+ 96 more Show less

1.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.101.2.111.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.3.01.3.11.3.101.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.91.4.01.4.11.4.101.4.21.4.31.4.41.4.51.4.71.4.81.4.91.5.01.5.11.5.101.5.111.5.121.5.131.5.141.5.151.5.161.5.171.5.181.5.191.5.21.5.201.5.211.5.221.5.231.5.241.5.31.5.41.5.51.5.61.5.71.5.81.5.91.6.01.6.11.6.101.6.111.6.121.6.131.6.141.6.151.6.21.6.31.6.41.6.51.6.61.6.71.6.81.6.92.0.02.0.12.0.22.0.32.0.42.0.52.0.62.1.02.1.0b12.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.8

Fixed in

1.6.162.1.9

References

https://github.com/nautobot/nautobot/security/advisories/GHSA-m732-wvh2-7cq4
https://nvd.nist.gov/vuln/detail/CVE-2024-29199
https://github.com/nautobot/nautobot/pull/5464
https://github.com/nautobot/nautobot/pull/5465
https://github.com/nautobot/nautobot/commit/2fd95c365f8477b26e06d60b999ddd36882d5750
https://github.com/nautobot/nautobot/commit/dd623e6c3307f48b6357fcc91925bcad5192abfb

Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-44798 PYSEC-2026-2228 GHSA-p3hx-pwf3-j8wr May 28, 2026

7.1 / 10
High
Network Low Low None Unchanged None Low High

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, a user with access to add/change a GitRepository record could use the REST API to directly set the current_head field on the record, which was not intended to be user-editable. Doing so could cause Nautobot's local clone(s) of the relevant repository to checkout a commit other than the latest commit on the specified branch (resulting in misleading state), or potentially to be unable to make use of the repository at all (until manually remediated) due to the current_head pointing to a nonexistent commit hash or malformed value. This vulnerability is fixed in 2.4.33 and 3.1.2.

Affected versions

1.0.01.0.0a11.0.0a21.0.0b11.0.0b21.0.0b31.0.0b41.0.11.0.21.0.31.1.01.1.1

+ 197 more Show less

1.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.101.2.111.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.3.01.3.11.3.101.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.91.4.01.4.11.4.101.4.21.4.31.4.41.4.51.4.71.4.81.4.91.5.01.5.11.5.101.5.111.5.121.5.131.5.141.5.151.5.161.5.171.5.181.5.191.5.21.5.201.5.211.5.221.5.231.5.241.5.31.5.41.5.51.5.61.5.71.5.81.5.91.6.01.6.11.6.101.6.111.6.121.6.131.6.141.6.151.6.161.6.171.6.181.6.191.6.21.6.201.6.211.6.221.6.231.6.241.6.251.6.261.6.271.6.281.6.291.6.31.6.301.6.311.6.321.6.41.6.51.6.61.6.71.6.81.6.92.0.02.0.12.0.22.0.32.0.42.0.52.0.62.1.02.1.0b12.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.0b12.2.12.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.0b12.3.12.3.102.3.112.3.122.3.132.3.142.3.152.3.15b12.3.162.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.0b12.4.12.4.102.4.112.4.122.4.132.4.142.4.152.4.162.4.172.4.182.4.192.4.22.4.202.4.212.4.222.4.232.4.242.4.252.4.262.4.272.4.282.4.292.4.32.4.302.4.312.4.322.4.42.4.52.4.62.4.72.4.82.4.93.0.03.0.13.0.103.0.113.0.23.0.33.0.43.0.53.0.63.0.73.0.83.0.93.1.03.1.0a13.1.0a23.1.0a33.1.0a43.1.0a53.1.1

Fixed in

2.4.333.1.2

References

https://github.com/nautobot/nautobot/releases/tag/v2.4.33
https://github.com/nautobot/nautobot/releases/tag/v3.1.2
https://github.com/nautobot/nautobot/commit/9deddfc91ad9260ad17b5e20084e9e2d15be3609
https://github.com/nautobot/nautobot/commit/c46f97040b2bde4320be36b23577f19a8bcbd8c3
https://github.com/nautobot/nautobot/security/advisories/GHSA-p3hx-pwf3-j8wr

Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-44797 PYSEC-2026-2227 GHSA-c35q-vxrp-ph26 May 28, 2026

8.5 / 10
High
Network Low Low None Changed High Low None

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot's Webhook data model and associated feature set could be configured by users with sufficient access to perform requests to various hosts and IP addresses that should not be permitted, allowing for various behaviors similar to server-side request forgery (SSRF). This vulnerability is fixed in 2.4.33 and 3.1.2.

Affected versions

1.0.01.0.0a11.0.0a21.0.0b11.0.0b21.0.0b31.0.0b41.0.11.0.21.0.31.1.01.1.1

+ 197 more Show less

1.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.101.2.111.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.3.01.3.11.3.101.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.91.4.01.4.11.4.101.4.21.4.31.4.41.4.51.4.71.4.81.4.91.5.01.5.11.5.101.5.111.5.121.5.131.5.141.5.151.5.161.5.171.5.181.5.191.5.21.5.201.5.211.5.221.5.231.5.241.5.31.5.41.5.51.5.61.5.71.5.81.5.91.6.01.6.11.6.101.6.111.6.121.6.131.6.141.6.151.6.161.6.171.6.181.6.191.6.21.6.201.6.211.6.221.6.231.6.241.6.251.6.261.6.271.6.281.6.291.6.31.6.301.6.311.6.321.6.41.6.51.6.61.6.71.6.81.6.92.0.02.0.12.0.22.0.32.0.42.0.52.0.62.1.02.1.0b12.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.0b12.2.12.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.0b12.3.12.3.102.3.112.3.122.3.132.3.142.3.152.3.15b12.3.162.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.0b12.4.12.4.102.4.112.4.122.4.132.4.142.4.152.4.162.4.172.4.182.4.192.4.22.4.202.4.212.4.222.4.232.4.242.4.252.4.262.4.272.4.282.4.292.4.32.4.302.4.312.4.322.4.42.4.52.4.62.4.72.4.82.4.93.0.03.0.13.0.103.0.113.0.23.0.33.0.43.0.53.0.63.0.73.0.83.0.93.1.03.1.0a13.1.0a23.1.0a33.1.0a43.1.0a53.1.1

Fixed in

2.4.333.1.2

References

https://github.com/nautobot/nautobot/releases/tag/v2.4.33
https://github.com/nautobot/nautobot/releases/tag/v3.1.2
https://github.com/nautobot/nautobot/commit/16aa4aa9796ab7a31c4d615ec945e1f16d8c77c4
https://github.com/nautobot/nautobot/commit/7324c8f0d8c7245fbc691e15d729adc2d2707d08
https://github.com/nautobot/nautobot/security/advisories/GHSA-c35q-vxrp-ph26

Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-44796 PYSEC-2026-2226 GHSA-qrpw-gjvh-x5gm May 28, 2026

6.5 / 10
Medium
Network Low Low None Unchanged None None High

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot UI object-bulk-rename endpoints (for example, /dcim/interfaces/rename/) were vulnerable to application-wide denial of service via maliciously crafted regular expressions in the find field in combination with the use_regex flag. This vulnerability is fixed in 2.4.33 and 3.1.2.

Affected versions

1.0.01.0.0a11.0.0a21.0.0b11.0.0b21.0.0b31.0.0b41.0.11.0.21.0.31.1.01.1.1

+ 197 more Show less

1.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.101.2.111.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.3.01.3.11.3.101.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.91.4.01.4.11.4.101.4.21.4.31.4.41.4.51.4.71.4.81.4.91.5.01.5.11.5.101.5.111.5.121.5.131.5.141.5.151.5.161.5.171.5.181.5.191.5.21.5.201.5.211.5.221.5.231.5.241.5.31.5.41.5.51.5.61.5.71.5.81.5.91.6.01.6.11.6.101.6.111.6.121.6.131.6.141.6.151.6.161.6.171.6.181.6.191.6.21.6.201.6.211.6.221.6.231.6.241.6.251.6.261.6.271.6.281.6.291.6.31.6.301.6.311.6.321.6.41.6.51.6.61.6.71.6.81.6.92.0.02.0.12.0.22.0.32.0.42.0.52.0.62.1.02.1.0b12.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.0b12.2.12.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.0b12.3.12.3.102.3.112.3.122.3.132.3.142.3.152.3.15b12.3.162.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.0b12.4.12.4.102.4.112.4.122.4.132.4.142.4.152.4.162.4.172.4.182.4.192.4.22.4.202.4.212.4.222.4.232.4.242.4.252.4.262.4.272.4.282.4.292.4.32.4.302.4.312.4.322.4.42.4.52.4.62.4.72.4.82.4.93.0.03.0.13.0.103.0.113.0.23.0.33.0.43.0.53.0.63.0.73.0.83.0.93.1.03.1.0a13.1.0a23.1.0a33.1.0a43.1.0a53.1.1

Fixed in

2.4.333.1.2

References

https://github.com/nautobot/nautobot/releases/tag/v2.4.33
https://github.com/nautobot/nautobot/releases/tag/v3.1.2
https://github.com/nautobot/nautobot/commit/5a30d0916953afbeedd24a784709e762cc3879cd
https://github.com/nautobot/nautobot/commit/c2b766966d814a7141f62c7bc90c85fefb7892ee
https://github.com/nautobot/nautobot/security/advisories/GHSA-qrpw-gjvh-x5gm

Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-44794 PYSEC-2026-2225 GHSA-wpxj-44w3-2j6x May 28, 2026

5.4 / 10
Medium
Network Low Low None Unchanged Low Low None

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, in the case of inter-object references via GenericForeignKey (a pattern allowing an object to reference another object that may belong to one of several different "content types" or database tables), when creating or updating an object containing a GenericForeignKey, Nautobot's REST API failed to enforce user "view" permissions when determining whether a given reference to another object would be valid. This vulnerability is fixed in 2.4.33 and 3.1.2.

Affected versions

1.0.01.0.0a11.0.0a21.0.0b11.0.0b21.0.0b31.0.0b41.0.11.0.21.0.31.1.01.1.1

+ 197 more Show less

1.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.101.2.111.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.3.01.3.11.3.101.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.91.4.01.4.11.4.101.4.21.4.31.4.41.4.51.4.71.4.81.4.91.5.01.5.11.5.101.5.111.5.121.5.131.5.141.5.151.5.161.5.171.5.181.5.191.5.21.5.201.5.211.5.221.5.231.5.241.5.31.5.41.5.51.5.61.5.71.5.81.5.91.6.01.6.11.6.101.6.111.6.121.6.131.6.141.6.151.6.161.6.171.6.181.6.191.6.21.6.201.6.211.6.221.6.231.6.241.6.251.6.261.6.271.6.281.6.291.6.31.6.301.6.311.6.321.6.41.6.51.6.61.6.71.6.81.6.92.0.02.0.12.0.22.0.32.0.42.0.52.0.62.1.02.1.0b12.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.0b12.2.12.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.0b12.3.12.3.102.3.112.3.122.3.132.3.142.3.152.3.15b12.3.162.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.0b12.4.12.4.102.4.112.4.122.4.132.4.142.4.152.4.162.4.172.4.182.4.192.4.22.4.202.4.212.4.222.4.232.4.242.4.252.4.262.4.272.4.282.4.292.4.32.4.302.4.312.4.322.4.42.4.52.4.62.4.72.4.82.4.93.0.03.0.13.0.103.0.113.0.23.0.33.0.43.0.53.0.63.0.73.0.83.0.93.1.03.1.0a13.1.0a23.1.0a33.1.0a43.1.0a53.1.1

Fixed in

2.4.333.1.2

References

https://github.com/nautobot/nautobot/releases/tag/v2.4.33
https://github.com/nautobot/nautobot/releases/tag/v3.1.2
https://github.com/nautobot/nautobot/commit/36cde7148a207234de6212ec074f321dbc9d1b5b
https://github.com/nautobot/nautobot/commit/9918bdb9bcf1eb42cda72c344f420a64ef7665f1
https://github.com/nautobot/nautobot/security/advisories/GHSA-wpxj-44w3-2j6x

Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-34203 GHSA-xmpv-j7p2-j873 PYSEC-2026-2224 Mar 31, 2026

Nautobot: Management of users via REST API does not apply configured password validators

2.7 / 10
Low
Network Low High None Unchanged None Low None

Impact

In Nautobot versions prior to 2.4.30 or prior to 3.0.10, user creation and editing via the REST API fails to apply the password validation rules defined by Django's AUTH_PASSWORD_VALIDATORS setting (which defaults to an empty list, i.e., no specific rules, but can be configured in Nautobot's nautobot_config.py to apply various rules if desired). This can potentially allow for the creation or modification of users to have passwords that are weak or otherwise do not comply with configured standards.

Management of users via the Nautobot admin UI does correctly enforce configured password validation at this time.

Patches

The issue is resolved in Nautobot versions 2.4.30 and 3.0.10 and later.

https://github.com/nautobot/nautobot/pull/8778

https://github.com/nautobot/nautobot/pull/8779

Workarounds

Review which users have been granted object permissions to create and modify user accounts as well as having access tokens for the REST API, and restrict access as appropriate.

It may be appropriate furthermore to rotate passwords for any user accounts suspected to have been given weak passwords.

References

https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-AUTH_PASSWORD_VALIDATORS

http://docs.djangoproject.com/en/4.2/topics/auth/passwords/#password-validation

Affected versions

1.0.01.0.0a11.0.0a21.0.0b11.0.0b21.0.0b31.0.0b41.0.11.0.21.0.31.1.01.1.1

+ 185 more Show less

1.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.101.2.111.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.3.01.3.11.3.101.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.91.4.01.4.11.4.101.4.21.4.31.4.41.4.51.4.71.4.81.4.91.5.01.5.11.5.101.5.111.5.121.5.131.5.141.5.151.5.161.5.171.5.181.5.191.5.21.5.201.5.211.5.221.5.231.5.241.5.31.5.41.5.51.5.61.5.71.5.81.5.91.6.01.6.11.6.101.6.111.6.121.6.131.6.141.6.151.6.161.6.171.6.181.6.191.6.21.6.201.6.211.6.221.6.231.6.241.6.251.6.261.6.271.6.281.6.291.6.31.6.301.6.311.6.321.6.41.6.51.6.61.6.71.6.81.6.92.0.02.0.12.0.22.0.32.0.42.0.52.0.62.1.02.1.0b12.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.0b12.2.12.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.0b12.3.12.3.102.3.112.3.122.3.132.3.142.3.152.3.15b12.3.162.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.0b12.4.12.4.102.4.112.4.122.4.132.4.142.4.152.4.162.4.172.4.182.4.192.4.22.4.202.4.212.4.222.4.232.4.242.4.252.4.262.4.272.4.282.4.292.4.32.4.42.4.52.4.62.4.72.4.82.4.93.0.03.0.13.0.23.0.33.0.43.0.53.0.63.0.73.0.83.0.9

Fixed in

2.4.303.0.10

References

https://github.com/nautobot/nautobot/security/advisories/GHSA-xmpv-j7p2-j873
https://nvd.nist.gov/vuln/detail/CVE-2026-34203
https://github.com/nautobot/nautobot/pull/8778
https://github.com/nautobot/nautobot/pull/8779
https://github.com/nautobot/nautobot/commit/589f7caf54124ad76bc9fcbb7bdcaa25627cd598
https://github.com/nautobot/nautobot/commit/d1ef3135aa02fa07de061e8c085f8cce425fe8c9

Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-49142 GHSA-wjw6-95h5-4jpx PYSEC-2025-79 Jun 10, 2025

Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating

Medium
Network High Low None

Impact

What kind of vulnerability is it? Who is impacted?

All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected.

Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot:

A malicious user could configure this feature set in ways that could expose the value of Secrets defined in Nautobot when the templated content is rendered.

A malicious user could configure this feature set in ways that could call Python APIs to modify data within Nautobot when the templated content is rendered, bypassing the object permissions assigned to the viewing user.

Patches

Has the problem been patched? What versions should users upgrade to?

Nautobot versions 1.6.32 and 2.4.10 will include fixes for the vulnerability.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

The vulnerability can be partially mitigated by configuring object permissions appropriately to limit the below actions to only trusted users:

extras.add_secret

extras.change_secret

extras.view_secret

extras.add_computedfield

extras.change_computedfield

extras.add_customlink

extras.change_customlink

extras.add_jobbutton

extras.change_jobbutton

References

Are there any links users can visit to find out more?

https://jinja.palletsprojects.com/en/stable/sandbox/

https://docs.djangoproject.com/en/4.2/ref/templates/api/#alters-data-description

https://github.com/nautobot/nautobot/pull/7417

https://github.com/nautobot/nautobot/pull/7429

Affected versions

1.0.01.0.0a11.0.0a21.0.0b11.0.0b21.0.0b31.0.0b41.0.11.0.21.0.31.1.01.1.1

+ 154 more Show less

1.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.101.2.111.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.3.01.3.11.3.101.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.91.4.01.4.11.4.101.4.21.4.31.4.41.4.51.4.71.4.81.4.91.5.01.5.11.5.101.5.111.5.121.5.131.5.141.5.151.5.161.5.171.5.181.5.191.5.21.5.201.5.211.5.221.5.231.5.241.5.31.5.41.5.51.5.61.5.71.5.81.5.91.6.01.6.11.6.101.6.111.6.121.6.131.6.141.6.151.6.161.6.171.6.181.6.191.6.21.6.201.6.211.6.221.6.231.6.241.6.251.6.261.6.271.6.281.6.291.6.31.6.301.6.311.6.41.6.51.6.61.6.71.6.81.6.92.0.02.0.12.0.22.0.32.0.42.0.52.0.62.1.02.1.0b12.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.0b12.2.12.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.0b12.3.12.3.102.3.112.3.122.3.132.3.142.3.152.3.15b12.3.162.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.0b12.4.12.4.22.4.32.4.42.4.52.4.62.4.72.4.82.4.9

Fixed in

1.6.322.4.10

References

https://github.com/nautobot/nautobot/security/advisories/GHSA-wjw6-95h5-4jpx
https://nvd.nist.gov/vuln/detail/CVE-2025-49142
https://github.com/nautobot/nautobot/pull/7417
https://github.com/nautobot/nautobot/pull/7429
https://docs.djangoproject.com/en/4.2/ref/templates/api/#alters-data-description
https://github.com/nautobot/nautobot

Updated Jun 09, 2026 · Source: OSV.dev

1–10 of 17

Insights

Releases per month

last 12 months

Release mix

major 2
minor 12
patch 199
pre 22

236 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More