SB2026110992 - Multiple vulnerabilities in Nautobot

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110992

SB2026110992 - Multiple vulnerabilities in Nautobot

Published: November 9, 2026

Security Bulletin ID SB2026110992
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 vulnerabilities.


1) Improper Authorization (CVE-ID: N/A)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged remote attacker to make Nautobot jobs act on objects they cannot view and discover their existence.

The vulnerability exists due to missing object view permission checks when Job and JobButtonReceiver execution paths resolve user-supplied object inputs. A low-privileged remote attacker with permission to run the target job can submit a crafted web form or REST API request containing an unauthorized object's ID to pass that object to the job.


2) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged remote attacker with permission to view a single object to disclose confidential data from related objects.

The vulnerability exists due to insufficient restrictions on attribute dictionaries used to identify related objects in Nautobot REST API requests and CSV imports. A low-privileged remote attacker can submit crafted nested queries to determine related object existence and iteratively infer API tokens or password hashes from User records reachable through object relationships.


3) Improper Authorization (CVE-ID: N/A)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged remote attacker to modify user or group relationships without permission to view those users or groups and discover whether they exist.

The vulnerability exists due to missing related-object permission checks when Nautobot processes REST API requests or Import Objects jobs. A low-privileged remote attacker can assign these relationships with appropriate object creation or update permissions despite lacking view_user or view_group permissions.


4) Improper Authorization (CVE-ID: N/A)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged attacker to link newly created Nautobot objects to related objects outside their viewing permissions and infer their existence.

The vulnerability exists due to missing view-permission checks on related objects referenced during CSV imports through the Import Objects job. A low-privileged attacker can submit an import with permission to create the target object type and run that job, establishing unauthorized relationships and learning whether referenced objects exist.


5) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an authenticated attacker to execute JavaScript in another Nautobot user's session, including an administrator's.

The vulnerability exists due to unescaped device type model names and software version aliases or version strings in software image summaries on Device, Virtual Machine and Inventory Item create or edit forms. An authenticated attacker with permission to add or change these records can inject scripts that read data or make changes as the victim when the victim opens a form referencing the affected record.


6) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an authenticated attacker to execute arbitrary JavaScript in another Nautobot user's session, including an administrator's.

The vulnerability exists due to unescaped custom field labels and choice values on Nautobot's Import Objects page. An authenticated attacker can inject malicious content with permission to add or change custom fields or choices, gaining the victim's data access and modification capabilities when the victim opens the page for an applicable content type.


7) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a low-privileged remote attacker to execute stored scripts in another user's authenticated Nautobot session.

The vulnerability exists due to unsafe rendering of Required Validation Rule custom error messages when users submit create or edit forms with a targeted field empty. A low-privileged remote attacker can use permission to add or change these rules to store malicious messages that execute with the victim's permissions, potentially including administrator privileges.


Remediation

Install update from vendor's website.

References