SB2026072717 - Multiple vulnerabilities in Nautobot

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072717

SB2026072717 - Multiple vulnerabilities in Nautobot

Published: July 27, 2026

Security Bulletin ID SB2026072717
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 40% Low 60%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Improper Authorization (CVE-ID: N/A)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper authorization in the REST API depth query parameter handling when traversing related objects through API requests. A remote user can send a crafted API request using the depth parameter to disclose sensitive information.

The issue affects permission enforcement for related objects reached from an initially authorized root object.


2) Insufficient Granularity of Access Control (CVE-ID: N/A)

CWE-ID: CWE-1220 - Insufficient Granularity of Access Control

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute code on the worker.

The vulnerability exists due to improper access control in the Job Hook dispatch path when triggering a JobHookReceiver by editing a matching object. A remote user can point a hook at an arbitrary JobHookReceiver and trigger it to execute code on the worker.

Exploitation requires permission to manage Job Hooks but not the run_job permission.


3) Improper Neutralization of Special Elements Used in a Template Engine (CVE-ID: N/A)

CWE-ID: CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary SQL queries and execute arbitrary code.

The vulnerability exists due to improper neutralization of special elements used in a template engine in the Jinja2 sandboxed template renderer when rendering a user-authored Jinja2 template with a live database object in context. A remote user can author a crafted template to execute arbitrary SQL queries and execute arbitrary code.

Code execution on the database host is possible when the database role is a PostgreSQL superuser.


4) Improper Authorization (CVE-ID: N/A)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper authorization in the GraphQL implementation when traversing related models through GraphQL queries. A remote user can send a crafted GraphQL query to disclose sensitive information.

The issue occurs because object permissions are enforced at the root of the query but not on traversed related models.


5) Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVE-ID: N/A)

CWE-ID: CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to exposure of sensitive system information in the Jinja2 template rendering context and the settings_or_config template filter when rendering user-supplied templates. A remote user can supply a crafted template to disclose sensitive information.

The issue can be reached through the settings_or_config template filter and through the settings context processor that exposes the full settings object to request-bound templates and plugin template extensions.


Remediation

Install update from vendor's website.

References