SB2026101469 - Multiple vulnerabilities in Nautobot

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026101469

SB2026101469 - Multiple vulnerabilities in Nautobot

Published: October 14, 2026

Security Bulletin ID SB2026101469
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 40% Low 60%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Reliance on Untrusted Inputs in a Security Decision (CVE-ID: N/A)

CWE-ID: CWE-807 - Reliance on Untrusted Inputs in a Security Decision

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass data validation rules and submit values those rules were configured to reject.

The vulnerability exists due to reliance on untrusted input in validation decisions in RegularExpressionValidationRule when rendering regular expression patterns as Jinja2 templates using the object being validated. A remote user can submit a field value that alters the resulting regular expression to match anything to bypass data validation rules and submit values those rules were configured to reject.

Only rules with context_processing enabled are exposed; this setting is disabled by default. Exploitation requires add or change permission on the targeted model, and the integrity impact is limited to fields already writable by the user and governed by such a rule.


2) Improper Neutralization of Special Elements Used in a Template Engine (CVE-ID: N/A)

CWE-ID: CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive database information and take over other users' accounts.

The vulnerability exists due to improper neutralization of special elements in the Jinja2 template engine when rendering user-authored templates in Nautobot. A remote user can author a template that escapes the sandbox and runs database read queries to disclose sensitive database information and take over other users' accounts.

Exploitation requires permission to author templates. Confirmed rendering paths include Computed Fields, Export Templates and Custom Links. Disclosed cleartext API tokens carry their owners' full REST API privileges. In the Custom Link case, the stored template evaluates when another user views the object, without further action by its author.


3) Incomplete List of Disallowed Inputs (CVE-ID: N/A)

CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information and take over other users' accounts.

The vulnerability exists due to incomplete restrictions on sensitive field access in Nautobot's Jinja2 template environment when rendering user-authored templates with a live object or queryset in the context. A remote user can author and render a template that accesses sensitive fields through queryset projections to disclose sensitive information and take over other users' accounts.

Only deployments with STRICT_SENSITIVE_FIELDS set to False, its default value, are affected. Exposed credentials include other users' REST API token keys and password hashes, including those belonging to administrators. A disclosed API token grants its owner's full REST API privileges.


4) Inefficient regular expression complexity (CVE-ID: N/A)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to inefficient regular expression complexity in Nautobot's data validation engine when evaluating submitted values against regular expression validation rules without a bound on backtracking. A remote user can submit crafted model data that introduces catastrophic backtracking into a rule's pattern through enabled Jinja2 context processing to cause a denial of service.

This exploitation path requires add or change permission on the targeted model. Rules are evaluated during model creation and updates, including other users' saves. Sufficient concurrent submissions can exhaust the worker pool. The data compliance audit job also evaluates disabled rules across every object of the targeted content type.


5) Inefficient regular expression complexity (CVE-ID: N/A)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to cause a denial of service.

The vulnerability exists due to inefficient regular expression complexity in Nautobot's custom field validation_regex evaluation when validating submitted values during object creation and updates. A remote privileged user can configure a pattern that exhibits catastrophic backtracking and submit nonmatching values concurrently to cause a denial of service.

Configuring a custom field requires the extras.add_customfield or extras.change_customfield permission. Evaluation is reached through the web UI, REST API, GraphQL mutations, CSV import and Jobs. The configured pattern applies to all users of the instance, and the person who configured it need not be present when it triggers.


Remediation

Install update from vendor's website.

References