Information disclosure in Nautobot - #VU162765
Published: November 9, 2026
Vulnerability identifier: #VU162765
CSH Severity: Low
CVSS v4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged remote attacker with permission to view a single object to disclose confidential data from related objects.
The vulnerability exists due to insufficient restrictions on attribute dictionaries used to identify related objects in Nautobot REST API requests and CSV imports. A low-privileged remote attacker can submit crafted nested queries to determine related object existence and iteratively infer API tokens or password hashes from User records reachable through object relationships.
Affected software
Nautobot
Remediation
Install security update from vendor's website.
Nautobot - addressed in versions 2.4.45, 3.2.8