Reliance on Untrusted Inputs in a Security Decision in Nautobot - #VU155745
Published: October 14, 2026
Vulnerability details
The vulnerability allows a remote user to bypass data validation rules and submit values those rules were configured to reject.
The vulnerability exists due to reliance on untrusted input in validation decisions in RegularExpressionValidationRule when rendering regular expression patterns as Jinja2 templates using the object being validated. A remote user can submit a field value that alters the resulting regular expression to match anything to bypass data validation rules and submit values those rules were configured to reject.
Only rules with context_processing enabled are exposed; this setting is disabled by default. Exploitation requires add or change permission on the targeted model, and the integrity impact is limited to fields already writable by the user and governed by such a rule.