nautobot

Network Source of Truth & Network Automation Platform

View on Pypi

View on Github

Activity

Latest release: 2d ago
Total releases: 244
Cadence: ~3 days
Last 12 months: 63

Reach

Stars: 1.6k

Details

License: Apache-2.0
First release: Feb 24, 2021

Releases

Version	Released
`3.2.8` patch	Oct 27, 2026
`2.4.45` patch	Oct 27, 2026
`3.2.7` patch	Oct 13, 2026
`2.4.44` patch	Oct 13, 2026
`3.2.6` patch	Sep 28, 2026
`2.4.43` patch	Sep 28, 2026
`3.2.5` patch	Sep 15, 2026
`2.4.42` patch	Sep 15, 2026
`3.2.4` patch	Aug 31, 2026
`2.4.41` patch	Aug 31, 2026
`2.4.40` patch	Aug 17, 2026
`3.2.3` patch	Aug 17, 2026
`3.2.2` patch	Aug 03, 2026
`2.4.39` patch	Aug 03, 2026
`3.2.1` patch	Jul 28, 2026
`3.2.0` minor	Jul 27, 2026
`2.4.38` patch	Jul 27, 2026
`3.2.0b2` pre	Jul 23, 2026
`2.4.37` patch	Jul 17, 2026
`3.1.8` patch	Jul 17, 2026
`3.2.0b1` pre	Jul 09, 2026
`3.1.7` patch 2 CVEs	Jul 06, 2026
`3.1.6` patch 2 CVEs	Jun 23, 2026
`2.4.36` patch 1 CVE	Jun 22, 2026
`3.1.5` patch 2 CVEs	Jun 22, 2026
`2.4.35` patch 1 CVE	Jun 08, 2026
`3.1.4` patch 2 CVEs	Jun 08, 2026
`2.4.34` patch 1 CVE	May 26, 2026
`3.1.3` patch 2 CVEs	May 26, 2026
`2.4.33` patch 1 CVE	May 08, 2026
`3.1.2` patch 2 CVEs	May 08, 2026
`2.4.32` patch 5 CVEs	Apr 27, 2026
`3.1.1` patch 6 CVEs	Apr 27, 2026
`3.1.0` minor 6 CVEs	Apr 14, 2026
`2.4.31` patch 5 CVEs	Apr 09, 2026
`3.0.11` patch 6 CVEs	Apr 08, 2026
`3.1.0a5` pre 6 CVEs	Apr 07, 2026
`3.1.0a4` pre 6 CVEs	Apr 02, 2026
`2.4.30` patch 5 CVEs	Mar 31, 2026
`3.0.10` patch 6 CVEs	Mar 30, 2026
`2.4.29` patch 6 CVEs	Mar 17, 2026
`3.0.9` patch 7 CVEs	Mar 17, 2026
`2.4.28` patch 6 CVEs	Mar 02, 2026
`3.0.8` patch 7 CVEs	Mar 02, 2026
`3.1.0a3` pre 6 CVEs	Feb 25, 2026
`2.4.27` patch 6 CVEs	Feb 17, 2026
`3.0.7` patch 7 CVEs	Feb 17, 2026
`3.1.0a2` pre 6 CVEs	Feb 11, 2026
`3.1.0a1` pre 6 CVEs	Feb 10, 2026
`2.4.26` patch 6 CVEs	Feb 02, 2026

1–50 of 244

Repository

nautobot/nautobot

Forks: 425
Open issues: 969
Language: Python
: 6.7/ 10

nautobot
python
network-automation
ipam
dcim
sot

Dependencies (63)

Depends on

3.2.8

Used by

Supply-chain exposure

91 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (19)

CVE-2026-83805 PYSEC-2026-4111 GHSA-q4c5-2j6f-r476 Oct 01, 2026

Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs

6.4 / 10
Medium
Network Low Low None Changed Low Low None

Impact

This is an authorization bypass that escalates into unauthorized server-side job execution.

Primary impact - self-approval: The approver checks (approver-group membership, change permission on the object under review, one-response-per-user) are enforced only in the approve/deny actions on ApprovalWorkflowStage. The generic ApprovalWorkflowStageResponse create endpoint enforces none of them, so a user holding only extras.add_approvalworkflowstageresponse can POST approved responses directly and drive a stage past its min_approvers threshold with no legitimate approver involved. The serializer also exposes user and state as writable, letting the attacker attribute responses to arbitrary users.

Escalated impact job activation: Because the approval workflow gates a ScheduledJob, self-approval does not stop at the approval record. Stage approval cascades through ApprovalWorkflow.save() to on_workflow_approved(), which sets the target job to enabled/active.

Patches

Fixed in Nautobot v3.1.8

Workarounds

Restrict the extras.add_approvalworkflowstageresponse permission so that no untrusted user holds it; approval responses should only ever be created via the stage approve/deny actions. There is no configuration flag that disables the generic create endpoint prior to the patch.

Affected versions

3.0.03.0.13.0.103.0.113.0.23.0.33.0.43.0.53.0.63.0.73.0.83.0.9

+ 13 more Show less

3.1.03.1.0a13.1.0a23.1.0a33.1.0a43.1.0a53.1.13.1.23.1.33.1.43.1.53.1.63.1.7

Fixed in

3.1.8

References

https://github.com/nautobot/nautobot/security/advisories/GHSA-q4c5-2j6f-r476
https://github.com/nautobot/nautobot/commit/8682707d0391cbfd7694e3276127b78dc9cf29d8
https://github.com/nautobot/nautobot
https://github.com/nautobot/nautobot/releases/tag/v3.1.8
https://pypi.org/project/nautobot
https://github.com/advisories/GHSA-q4c5-2j6f-r476

Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-83801 PYSEC-2026-4110 GHSA-56v6-2fhr-wxgq Oct 01, 2026

Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

5.4 / 10
Medium
Network Low Low Required Changed Low Low None

Impact

What kind of vulnerability is it? Who is impacted?

It has two related instances that share the same root cause: a user-controlled model field is assigned verbatim to a form field's help_text, which is rendered with Django's |safe filter (render_field.html), bypassing auto-escaping.

In both cases the script executes in the browser of any user who opens an affected create or edit form, including administrators and superusers. Because the payload runs in the victim's authenticated session, it can lead to actions performed as the victim, session/token theft, and further privilege escalation. Exploitation requires the victim to open an affected form.

Relationship description

A user who holds the add/change permission for Relationships (extras.add_relationship / extras.change_relationship) can set a Relationship's description to an HTML/JavaScript payload. That description is used as the help text of the relationship's form field and is rendered on the create/edit page of every object type the relationship applies to.

Module Family name

A user who holds the add/change permission for Module Families (dcim.add_modulefamily / dcim.change_modulefamily) can put a payload in a Module Family name, which is interpolated into the module_family field's help text on the Module "Install module" form for any module bay assigned to that family.

Patches

Has the problem been patched? What versions should users upgrade to?

Fixes are available in Nautobot v2.4.37+ & v3.1.8+

Note: The underlying weakness exists in earlier EOL versions of Nautobot (v1.x). Users on those older EOL versions are highly encouraged to upgrade to a supported version.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

There is no configuration-only fix. To remediate without upgrading:

Restrict the extras.add_relationship / extras.change_relationship and dcim.add_modulefamily / dcim.change_modulefamily permissions to fully trusted administrators only.

Audit existing Relationship description values and Module Family name values for embedded HTML / <script> content and remove any payloads.

Note that limiting who can open create/edit forms does not fully mitigate the issue, since the payload targets any user (including admins) who opens an affected form.

Credit

Credit for this discovery goes to Habibullo Izzatilloyev.

Affected versions

1.0.01.0.0a11.0.0a21.0.0b11.0.0b21.0.0b31.0.0b41.0.11.0.21.0.31.1.01.1.1

+ 207 more Show less

1.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.101.2.111.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.3.01.3.11.3.101.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.91.4.01.4.11.4.101.4.21.4.31.4.41.4.51.4.71.4.81.4.91.5.01.5.11.5.101.5.111.5.121.5.131.5.141.5.151.5.161.5.171.5.181.5.191.5.21.5.201.5.211.5.221.5.231.5.241.5.31.5.41.5.51.5.61.5.71.5.81.5.91.6.01.6.11.6.101.6.111.6.121.6.131.6.141.6.151.6.161.6.171.6.181.6.191.6.21.6.201.6.211.6.221.6.231.6.241.6.251.6.261.6.271.6.281.6.291.6.31.6.301.6.311.6.321.6.41.6.51.6.61.6.71.6.81.6.92.0.02.0.12.0.22.0.32.0.42.0.52.0.62.1.02.1.0b12.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.0b12.2.12.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.0b12.3.12.3.102.3.112.3.122.3.132.3.142.3.152.3.15b12.3.162.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.0b12.4.12.4.102.4.112.4.122.4.132.4.142.4.152.4.162.4.172.4.182.4.192.4.22.4.202.4.212.4.222.4.232.4.242.4.252.4.262.4.272.4.282.4.292.4.32.4.302.4.312.4.322.4.332.4.342.4.352.4.362.4.42.4.52.4.62.4.72.4.82.4.93.0.03.0.13.0.103.0.113.0.23.0.33.0.43.0.53.0.63.0.73.0.83.0.93.1.03.1.0a13.1.0a23.1.0a33.1.0a43.1.0a53.1.13.1.23.1.33.1.43.1.53.1.63.1.7

Fixed in

2.4.373.1.8

References

https://github.com/nautobot/nautobot/security/advisories/GHSA-56v6-2fhr-wxgq
https://github.com/nautobot/nautobot/commit/e6ff20d50e0759135c6d278e7b2ceec56ed9b3c8
https://github.com/nautobot/nautobot/commit/f8a62466f3ebc42759a6373e7c79b0cad5751c2f
https://github.com/nautobot/nautobot
https://github.com/nautobot/nautobot/releases/tag/v2.4.37
https://github.com/nautobot/nautobot/releases/tag/v3.1.8

Updated Oct 01, 2026 · Source: OSV.dev
CVE-2025-49143 PYSEC-2026-1689 GHSA-rh67-4c8j-hjjh Jul 07, 2026

Nautobot may allows uploaded media files to be accessible without authentication

Medium
Network High None None

Impact

Files uploaded by users to Nautobot's MEDIA_ROOT directory, including DeviceType image attachments as well as images attached to a Location, Device, or Rack, are served to users via a URL endpoint that was not enforcing user authentication. As a consequence, such files can be retrieved by anonymous users who know or can guess the correct URL for a given file.

For DeviceType image attachments, a mitigating factor is that no URL endpoint exists for listing the contents of the devicetype-images/ subdirectory, and the file names are as specified by the uploading user, so any given DeviceType image attachment can only be retrieved by correctly guessing its file name.

Similarly, for all other image attachments, while the images can be listed by accessing the /api/extras/image-attachments/ endpoint as an authenticated user only, absent that authenticated access, accessing the files would again require guessing file names correctly.

Patches

Nautobot v2.4.10 and v1.6.32 will address this issue by adding enforcement of Nautobot user authentication to this endpoint.

Workarounds

No workaround other than applying the patch given in https://github.com/nautobot/nautobot/pull/6672 (2.x) or https://github.com/nautobot/nautobot/pull/6703 (1.6)

References

Are there any links users can visit to find out more?

https://github.com/nautobot/nautobot/commit/9c892dc300429948a4714f743c9c2879d8987340

https://github.com/nautobot/nautobot/commit/d99a53b065129cff3a0fa9abe7355a9ef1ad4c95

Affected versions

1.0.01.0.0a11.0.0a21.0.0b11.0.0b21.0.0b31.0.0b41.0.11.0.21.0.31.1.01.1.1

+ 154 more Show less

1.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.101.2.111.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.3.01.3.11.3.101.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.91.4.01.4.11.4.101.4.21.4.31.4.41.4.51.4.71.4.81.4.91.5.01.5.11.5.101.5.111.5.121.5.131.5.141.5.151.5.161.5.171.5.181.5.191.5.21.5.201.5.211.5.221.5.231.5.241.5.31.5.41.5.51.5.61.5.71.5.81.5.91.6.01.6.11.6.101.6.111.6.121.6.131.6.141.6.151.6.161.6.171.6.181.6.191.6.21.6.201.6.211.6.221.6.231.6.241.6.251.6.261.6.271.6.281.6.291.6.31.6.301.6.311.6.41.6.51.6.61.6.71.6.81.6.92.0.02.0.12.0.22.0.32.0.42.0.52.0.62.1.02.1.0b12.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.0b12.2.12.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.0b12.3.12.3.102.3.112.3.122.3.132.3.142.3.152.3.15b12.3.162.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.0b12.4.12.4.22.4.32.4.42.4.52.4.62.4.72.4.82.4.9

Fixed in

1.6.322.4.10

References

https://github.com/nautobot/nautobot/security/advisories/GHSA-rh67-4c8j-hjjh
https://nvd.nist.gov/vuln/detail/CVE-2025-49143
https://github.com/nautobot/nautobot/pull/6672
https://github.com/nautobot/nautobot/pull/6703
https://github.com/nautobot/nautobot/commit/9c892dc300429948a4714f743c9c2879d8987340
https://github.com/nautobot/nautobot/commit/d99a53b065129cff3a0fa9abe7355a9ef1ad4c95

Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-34707 PYSEC-2026-1688 GHSA-r2hr-4v48-fjv3 Jul 07, 2026

Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages

7.5 / 10
High
Network Low High Required Changed Low High Low

Impact

A Nautobot user with admin privileges can modify the BANNER_TOP, BANNER_BOTTOM, and BANNER_LOGIN configuration settings via the /admin/constance/config/ endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of BANNER_LOGIN) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS).

Patches

Has the problem been patched? What versions should users upgrade to?

Patches will be released as part of Nautobot 1.6.22 and 2.2.4.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

As described in the Nautobot documentation, these settings are only configurable through the admin UI of Nautobot if they are not explicitly set to some non-empty value in the nautobot_config.py or equivalent Nautobot configuration file. Therefore, adding the following configuration to said file completely mitigates this vulnerability in both Nautobot 1.x and 2.x:

BANNER_LOGIN = " " BANNER_TOP = " " BANNER_BOTTOM = " "

or alternately (Nautobot 2.x only), if those variables are not defined explicitly in your configuration file, setting the following environment variables for the Nautobot user account serves the same purpose:

NAUTOBOT_BANNER_LOGIN=" " NAUTOBOT_BANNER_TOP=" " NAUTOBOT_BANNER_BOTTOM=" "

Limiting all users who do not need elevated privileges to non-admin access (is_superuser: False and is_staff: False) is a partial mitigation as well.

References

https://github.com/nautobot/nautobot/pull/5697

https://github.com/nautobot/nautobot/pull/5698

Affected versions

1.0.01.0.0a11.0.0a21.0.0b11.0.0b21.0.0b31.0.0b41.0.11.0.21.0.31.1.01.1.1

+ 108 more Show less

1.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.101.2.111.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.3.01.3.11.3.101.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.91.4.01.4.11.4.101.4.21.4.31.4.41.4.51.4.71.4.81.4.91.5.01.5.11.5.101.5.111.5.121.5.131.5.141.5.151.5.161.5.171.5.181.5.191.5.21.5.201.5.211.5.221.5.231.5.241.5.31.5.41.5.51.5.61.5.71.5.81.5.91.6.01.6.11.6.101.6.111.6.121.6.131.6.141.6.151.6.161.6.171.6.181.6.191.6.21.6.201.6.211.6.31.6.41.6.51.6.61.6.71.6.81.6.92.0.02.0.12.0.22.0.32.0.42.0.52.0.62.1.02.1.0b12.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.0b12.2.12.2.22.2.3

Fixed in

1.6.222.2.4

References

https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3
https://nvd.nist.gov/vuln/detail/CVE-2024-34707
https://github.com/nautobot/nautobot/pull/5697
https://github.com/nautobot/nautobot/pull/5698
https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c
https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423

Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-32979 PYSEC-2026-1686 GHSA-jxgr-gcj5-cqqg Jul 07, 2026

nautobot has reflected Cross-site Scripting potential in all object list views

7.5 / 10
High
Network High None Required Changed Low High Low

Impact

It was discovered that due to improper handling and escaping of user-provided query parameters, a maliciously crafted Nautobot URL could potentially be used to execute a Reflected Cross-Site Scripting (Reflected XSS) attack against users. All filterable object-list views in Nautobot are vulnerable, including:

/dcim/location-types/

/dcim/locations/

/dcim/racks/

/dcim/rack-groups/

/dcim/rack-reservations/

/dcim/rack-elevations/

/tenancy/tenants/

/tenancy/tenant-groups/

/extras/tags/

/extras/statuses/

/extras/roles/

/extras/dynamic-groups/

/dcim/devices/

/dcim/platforms/

/dcim/virtual-chassis/

/dcim/device-redundancy-groups/

/dcim/interface-redundancy-groups/

/dcim/device-types/

/dcim/manufacturers/

/dcim/cables/

/dcim/console-connections/

/dcim/power-connections/

/dcim/interface-connections/

/dcim/interfaces/

/dcim/front-ports/

/dcim/rear-ports/

/dcim/console-ports/

/dcim/console-server-ports/

/dcim/power-ports/

/dcim/power-outlets/

/dcim/device-bays/

/dcim/inventory-items/

/ipam/ip-addresses/

/ipam/prefixes

/ipam/rirs/

/ipam/namespaces/

/ipam/vrfs/

/ipam/route-targets/

/ipam/vlans/

/ipam/vlan-groups/

/ipam/services/

/virtualization/virtual-machines/

/virtualization/interfaces/

/virtualization/clusters/

/virtualization/cluster-types/

/virtualization/cluster-groups/

/circuits/circuits/

/circuits/circuit-types/

/circuits/providers/

/circuits/provider-networks/

/dcim/power-feeds/

/dcim/power-panels/

/extras/secrets/

/extras/secrets-groups/

/extras/jobs/

/extras/jobs/scheduled-jobs/approval-queue/

/extras/jobs/scheduled-jobs/

/extras/job-results/

/extras/job-hooks/

/extras/job-buttons/

/extras/object-changes/

/extras/git-repositories/

/extras/graphql-queries/

/extras/relationships/

/extras/notes/

/extras/config-contexts/

/extras/config-context-schemas/

/extras/export-templates/

/extras/external-integrations/

/extras/webhooks/

/extras/computed-fields/

/extras/custom-fields/

/extras/custom-links/

as well as any similar object-list views provided by any Nautobot App.

Patches

Fixed in Nautobot 1.6.20 and 2.2.3.

Workarounds

No workaround has been identified

References

#5646

#5647

Credit to Michael Panorios for reporting this issue.

Affected versions

1.5.01.5.11.5.101.5.111.5.121.5.131.5.141.5.151.5.161.5.171.5.181.5.19

+ 55 more Show less

1.5.21.5.201.5.211.5.221.5.231.5.241.5.31.5.41.5.51.5.61.5.71.5.81.5.91.6.01.6.11.6.101.6.111.6.121.6.131.6.141.6.151.6.161.6.171.6.181.6.191.6.21.6.31.6.41.6.51.6.61.6.71.6.81.6.92.0.02.0.12.0.22.0.32.0.42.0.52.0.62.1.02.1.0b12.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.0b12.2.12.2.2

Fixed in

1.6.202.2.3

References

https://github.com/nautobot/nautobot/security/advisories/GHSA-jxgr-gcj5-cqqg
https://nvd.nist.gov/vuln/detail/CVE-2024-32979
https://github.com/nautobot/nautobot/pull/5646
https://github.com/nautobot/nautobot/pull/5647
https://github.com/nautobot/nautobot/commit/2ea5797ea43646d5d8b29433e4c707b5a9758146
https://github.com/nautobot/nautobot/commit/42440ebd9b381534ad89d62420ebea00d703d64e

Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-29199 PYSEC-2026-1687 GHSA-m732-wvh2-7cq4 Jul 07, 2026

Unauthenticated views may expose information to anonymous users

3.7 / 10
Low
Network High None None Unchanged Low None None

Impact

A number of Nautobot URL endpoints were found to be improperly accessible to unauthenticated (anonymous) users, including the following:

/api/graphql/ (1)

/api/users/users/session/ (Nautobot 2.x only; the only information exposed to an anonymous user is which authentication backend classes are enabled on this Nautobot instance)

/dcim/racks/<uuid:pk>/dynamic-groups/ (1)

/dcim/devices/<uuid:pk>/dynamic-groups/ (1)

/extras/job-results/<uuid:pk>/log-table/

/extras/secrets/provider/<str:provider_slug>/form/ (the only information exposed to an anonymous user is the fact that a secrets provider with the given slug (e.g. environment-variable or text-file) is supported by this Nautobot instance)

/ipam/prefixes/<uuid:pk>/dynamic-groups/ (1)

/ipam/ip-addresses/<uuid:pk>/dynamic-groups/ (1)

/virtualization/clusters/<uuid:pk>/dynamic-groups/ (1)

/virtualization/virtual-machines/<uuid:pk>/dynamic-groups/ (1)

(1) These endpoints will not disclose any Nautobot data to an unauthenticated user unless the Nautobot configuration variable EXEMPT_VIEW_PERMISSIONS is changed from its default value (an empty list) to permit access to specific data by unauthenticated users.

Of these endpoints, the only one that poses any significant risk of sensitive information disclosure under normal Nautobot operation with a default configuration is /extras/job-results/<uuid:pk>/log-table/. This endpoint returns an HTML table containing all of the logs associated with the specified JobResult; while these logs may contain sensitive information depending on the Jobs executed in Nautobot, this exposure is mitigated somewhat by the fact that any attacker would have to have prior knowledge of the existence of a JobResult with a particular UUID.

In the interest of full disclosure, the following additional endpoints were also accessible to anonymous users, but do not disclose any sensitive data when accessed (only a listing of other API endpoints).

/api/

/api/circuits/

/api/dcim/

/api/extras/

/api/ipam/

/api/plugins/

/api/tenancy/

/api/users/

/api/virtualization/

All of the above endpoints have been corrected to require user authentication, with the exception of /api/users/users/session/ which is unused at this time and therefore has been simply removed from Nautobot 2.1.9. Additionally, we have added test automation which enumerates available Nautobot URL endpoints and verifies that appropriate authentication requirements are in place; this test was instrumental in identifying the above comprehensive list.

Patches

Fixes will be included in Nautobot 1.6.16 and 2.1.9.

Workarounds

Partial workaround: If your configuration includes a non-default value for EXEMPT_VIEW_PERMISSIONS (the Nautobot default is an empty list), reverting it to default will prevent exposure of Nautobot information to unauthenticated users via the endpoints marked with (1) above.

References

Are there any links users can visit to find out more?

Affected versions

1.0.01.0.0a11.0.0a21.0.0b11.0.0b21.0.0b31.0.0b41.0.11.0.21.0.31.1.01.1.1

+ 96 more Show less

1.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.101.2.111.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.3.01.3.11.3.101.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.91.4.01.4.11.4.101.4.21.4.31.4.41.4.51.4.71.4.81.4.91.5.01.5.11.5.101.5.111.5.121.5.131.5.141.5.151.5.161.5.171.5.181.5.191.5.21.5.201.5.211.5.221.5.231.5.241.5.31.5.41.5.51.5.61.5.71.5.81.5.91.6.01.6.11.6.101.6.111.6.121.6.131.6.141.6.151.6.21.6.31.6.41.6.51.6.61.6.71.6.81.6.92.0.02.0.12.0.22.0.32.0.42.0.52.0.62.1.02.1.0b12.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.8

Fixed in

1.6.162.1.9

References

https://github.com/nautobot/nautobot/security/advisories/GHSA-m732-wvh2-7cq4
https://nvd.nist.gov/vuln/detail/CVE-2024-29199
https://github.com/nautobot/nautobot/pull/5464
https://github.com/nautobot/nautobot/pull/5465
https://github.com/nautobot/nautobot/commit/2fd95c365f8477b26e06d60b999ddd36882d5750
https://github.com/nautobot/nautobot/commit/dd623e6c3307f48b6357fcc91925bcad5192abfb

Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-44798 PYSEC-2026-2228 GHSA-p3hx-pwf3-j8wr May 28, 2026

7.1 / 10
High
Network Low Low None Unchanged None Low High

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, a user with access to add/change a GitRepository record could use the REST API to directly set the current_head field on the record, which was not intended to be user-editable. Doing so could cause Nautobot's local clone(s) of the relevant repository to checkout a commit other than the latest commit on the specified branch (resulting in misleading state), or potentially to be unable to make use of the repository at all (until manually remediated) due to the current_head pointing to a nonexistent commit hash or malformed value. This vulnerability is fixed in 2.4.33 and 3.1.2.

Affected versions

1.0.01.0.0a11.0.0a21.0.0b11.0.0b21.0.0b31.0.0b41.0.11.0.21.0.31.1.01.1.1

+ 197 more Show less

1.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.101.2.111.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.3.01.3.11.3.101.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.91.4.01.4.11.4.101.4.21.4.31.4.41.4.51.4.71.4.81.4.91.5.01.5.11.5.101.5.111.5.121.5.131.5.141.5.151.5.161.5.171.5.181.5.191.5.21.5.201.5.211.5.221.5.231.5.241.5.31.5.41.5.51.5.61.5.71.5.81.5.91.6.01.6.11.6.101.6.111.6.121.6.131.6.141.6.151.6.161.6.171.6.181.6.191.6.21.6.201.6.211.6.221.6.231.6.241.6.251.6.261.6.271.6.281.6.291.6.31.6.301.6.311.6.321.6.41.6.51.6.61.6.71.6.81.6.92.0.02.0.12.0.22.0.32.0.42.0.52.0.62.1.02.1.0b12.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.0b12.2.12.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.0b12.3.12.3.102.3.112.3.122.3.132.3.142.3.152.3.15b12.3.162.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.0b12.4.12.4.102.4.112.4.122.4.132.4.142.4.152.4.162.4.172.4.182.4.192.4.22.4.202.4.212.4.222.4.232.4.242.4.252.4.262.4.272.4.282.4.292.4.32.4.302.4.312.4.322.4.42.4.52.4.62.4.72.4.82.4.93.0.03.0.13.0.103.0.113.0.23.0.33.0.43.0.53.0.63.0.73.0.83.0.93.1.03.1.0a13.1.0a23.1.0a33.1.0a43.1.0a53.1.1

Fixed in

2.4.333.1.2

References

https://github.com/nautobot/nautobot/releases/tag/v2.4.33
https://github.com/nautobot/nautobot/releases/tag/v3.1.2
https://github.com/nautobot/nautobot/commit/9deddfc91ad9260ad17b5e20084e9e2d15be3609
https://github.com/nautobot/nautobot/commit/c46f97040b2bde4320be36b23577f19a8bcbd8c3
https://github.com/nautobot/nautobot/security/advisories/GHSA-p3hx-pwf3-j8wr

Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-44797 PYSEC-2026-2227 GHSA-c35q-vxrp-ph26 May 28, 2026

8.5 / 10
High
Network Low Low None Changed High Low None

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot's Webhook data model and associated feature set could be configured by users with sufficient access to perform requests to various hosts and IP addresses that should not be permitted, allowing for various behaviors similar to server-side request forgery (SSRF). This vulnerability is fixed in 2.4.33 and 3.1.2.

Affected versions

1.0.01.0.0a11.0.0a21.0.0b11.0.0b21.0.0b31.0.0b41.0.11.0.21.0.31.1.01.1.1

+ 197 more Show less

1.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.101.2.111.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.3.01.3.11.3.101.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.91.4.01.4.11.4.101.4.21.4.31.4.41.4.51.4.71.4.81.4.91.5.01.5.11.5.101.5.111.5.121.5.131.5.141.5.151.5.161.5.171.5.181.5.191.5.21.5.201.5.211.5.221.5.231.5.241.5.31.5.41.5.51.5.61.5.71.5.81.5.91.6.01.6.11.6.101.6.111.6.121.6.131.6.141.6.151.6.161.6.171.6.181.6.191.6.21.6.201.6.211.6.221.6.231.6.241.6.251.6.261.6.271.6.281.6.291.6.31.6.301.6.311.6.321.6.41.6.51.6.61.6.71.6.81.6.92.0.02.0.12.0.22.0.32.0.42.0.52.0.62.1.02.1.0b12.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.0b12.2.12.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.0b12.3.12.3.102.3.112.3.122.3.132.3.142.3.152.3.15b12.3.162.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.0b12.4.12.4.102.4.112.4.122.4.132.4.142.4.152.4.162.4.172.4.182.4.192.4.22.4.202.4.212.4.222.4.232.4.242.4.252.4.262.4.272.4.282.4.292.4.32.4.302.4.312.4.322.4.42.4.52.4.62.4.72.4.82.4.93.0.03.0.13.0.103.0.113.0.23.0.33.0.43.0.53.0.63.0.73.0.83.0.93.1.03.1.0a13.1.0a23.1.0a33.1.0a43.1.0a53.1.1

Fixed in

2.4.333.1.2

References

https://github.com/nautobot/nautobot/releases/tag/v2.4.33
https://github.com/nautobot/nautobot/releases/tag/v3.1.2
https://github.com/nautobot/nautobot/commit/16aa4aa9796ab7a31c4d615ec945e1f16d8c77c4
https://github.com/nautobot/nautobot/commit/7324c8f0d8c7245fbc691e15d729adc2d2707d08
https://github.com/nautobot/nautobot/security/advisories/GHSA-c35q-vxrp-ph26

Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-44796 PYSEC-2026-2226 GHSA-qrpw-gjvh-x5gm May 28, 2026

6.5 / 10
Medium
Network Low Low None Unchanged None None High

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot UI object-bulk-rename endpoints (for example, /dcim/interfaces/rename/) were vulnerable to application-wide denial of service via maliciously crafted regular expressions in the find field in combination with the use_regex flag. This vulnerability is fixed in 2.4.33 and 3.1.2.

Affected versions

1.0.01.0.0a11.0.0a21.0.0b11.0.0b21.0.0b31.0.0b41.0.11.0.21.0.31.1.01.1.1

+ 197 more Show less

1.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.101.2.111.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.3.01.3.11.3.101.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.91.4.01.4.11.4.101.4.21.4.31.4.41.4.51.4.71.4.81.4.91.5.01.5.11.5.101.5.111.5.121.5.131.5.141.5.151.5.161.5.171.5.181.5.191.5.21.5.201.5.211.5.221.5.231.5.241.5.31.5.41.5.51.5.61.5.71.5.81.5.91.6.01.6.11.6.101.6.111.6.121.6.131.6.141.6.151.6.161.6.171.6.181.6.191.6.21.6.201.6.211.6.221.6.231.6.241.6.251.6.261.6.271.6.281.6.291.6.31.6.301.6.311.6.321.6.41.6.51.6.61.6.71.6.81.6.92.0.02.0.12.0.22.0.32.0.42.0.52.0.62.1.02.1.0b12.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.0b12.2.12.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.0b12.3.12.3.102.3.112.3.122.3.132.3.142.3.152.3.15b12.3.162.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.0b12.4.12.4.102.4.112.4.122.4.132.4.142.4.152.4.162.4.172.4.182.4.192.4.22.4.202.4.212.4.222.4.232.4.242.4.252.4.262.4.272.4.282.4.292.4.32.4.302.4.312.4.322.4.42.4.52.4.62.4.72.4.82.4.93.0.03.0.13.0.103.0.113.0.23.0.33.0.43.0.53.0.63.0.73.0.83.0.93.1.03.1.0a13.1.0a23.1.0a33.1.0a43.1.0a53.1.1

Fixed in

2.4.333.1.2

References

https://github.com/nautobot/nautobot/releases/tag/v2.4.33
https://github.com/nautobot/nautobot/releases/tag/v3.1.2
https://github.com/nautobot/nautobot/commit/5a30d0916953afbeedd24a784709e762cc3879cd
https://github.com/nautobot/nautobot/commit/c2b766966d814a7141f62c7bc90c85fefb7892ee
https://github.com/nautobot/nautobot/security/advisories/GHSA-qrpw-gjvh-x5gm

Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-44794 PYSEC-2026-2225 GHSA-wpxj-44w3-2j6x May 28, 2026

5.4 / 10
Medium
Network Low Low None Unchanged Low Low None

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, in the case of inter-object references via GenericForeignKey (a pattern allowing an object to reference another object that may belong to one of several different "content types" or database tables), when creating or updating an object containing a GenericForeignKey, Nautobot's REST API failed to enforce user "view" permissions when determining whether a given reference to another object would be valid. This vulnerability is fixed in 2.4.33 and 3.1.2.

Affected versions

1.0.01.0.0a11.0.0a21.0.0b11.0.0b21.0.0b31.0.0b41.0.11.0.21.0.31.1.01.1.1

+ 197 more Show less

1.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.101.2.111.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.3.01.3.11.3.101.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.91.4.01.4.11.4.101.4.21.4.31.4.41.4.51.4.71.4.81.4.91.5.01.5.11.5.101.5.111.5.121.5.131.5.141.5.151.5.161.5.171.5.181.5.191.5.21.5.201.5.211.5.221.5.231.5.241.5.31.5.41.5.51.5.61.5.71.5.81.5.91.6.01.6.11.6.101.6.111.6.121.6.131.6.141.6.151.6.161.6.171.6.181.6.191.6.21.6.201.6.211.6.221.6.231.6.241.6.251.6.261.6.271.6.281.6.291.6.31.6.301.6.311.6.321.6.41.6.51.6.61.6.71.6.81.6.92.0.02.0.12.0.22.0.32.0.42.0.52.0.62.1.02.1.0b12.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.0b12.2.12.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.0b12.3.12.3.102.3.112.3.122.3.132.3.142.3.152.3.15b12.3.162.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.0b12.4.12.4.102.4.112.4.122.4.132.4.142.4.152.4.162.4.172.4.182.4.192.4.22.4.202.4.212.4.222.4.232.4.242.4.252.4.262.4.272.4.282.4.292.4.32.4.302.4.312.4.322.4.42.4.52.4.62.4.72.4.82.4.93.0.03.0.13.0.103.0.113.0.23.0.33.0.43.0.53.0.63.0.73.0.83.0.93.1.03.1.0a13.1.0a23.1.0a33.1.0a43.1.0a53.1.1

Fixed in

2.4.333.1.2

References

https://github.com/nautobot/nautobot/releases/tag/v2.4.33
https://github.com/nautobot/nautobot/releases/tag/v3.1.2
https://github.com/nautobot/nautobot/commit/36cde7148a207234de6212ec074f321dbc9d1b5b
https://github.com/nautobot/nautobot/commit/9918bdb9bcf1eb42cda72c344f420a64ef7665f1
https://github.com/nautobot/nautobot/security/advisories/GHSA-wpxj-44w3-2j6x

Updated Jul 13, 2026 · Source: OSV.dev

1–10 of 19

Insights

Releases per month

last 12 months

Release mix

major 2
minor 12
patch 207
pre 22

244 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More