SB20260919187 - Multiple vulnerabilities in Nautobot

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260919187

SB20260919187 - Multiple vulnerabilities in Nautobot

Published: September 19, 2026

Security Bulletin ID SB20260919187
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 75% Low 25%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Cleartext storage of sensitive information (CVE-ID: N/A)

CWE-ID: CWE-312 - Cleartext Storage of Sensitive Information

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose API tokens and password hashes and gain administrative control of the Nautobot instance.

The vulnerability exists due to cleartext storage of sensitive information in Custom Link Jinja2 template rendering when rendering a custom link on an object detail page. A remote user can create a crafted Custom Link that exfiltrates credentials when viewed to disclose API tokens and password hashes and gain administrative control of the Nautobot instance.

User interaction is required because a viewer must follow the crafted link.


2) Incomplete List of Disallowed Inputs (CVE-ID: N/A)

CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read arbitrary database data, modify certain database objects, and potentially gain full control of the installation.

The vulnerability exists due to an incomplete deny list in the Jinja2 template sandbox when rendering user-authored templates. A remote user can author a crafted template to read arbitrary database data, modify certain database objects, and potentially gain full control of the installation.

No user interaction or unusual template context is required.


3) Uncontrolled Recursion (CVE-ID: CVE-2026-9358)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in the toString function in src/selectors/container.js of the AST serialization component when serializing a manipulated AST. A remote attacker can execute a manipulation to cause a denial of service.

User interaction is required.


4) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-84375)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in the js-yaml YAML loader when processing a crafted YAML document containing repeated merges of empty mappings. A remote attacker can submit a crafted YAML document to cause a denial of service.

In versions 3 and 4, merge support is enabled by default.


Remediation

Install update from vendor's website.

References