What’s Vulnerable › Products

nautobot vulnerabilities

19 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Check whether your nautobot version is affected

Latest nautobot vulnerabilities

• CVE-2026-83805 — Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs (CVSS 6.4)
• CVE-2026-83801 — Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text (CVSS 5.4)
• CVE-2026-44798 — Nautobot: GitRepository.current_head field should not be writable through REST API (CVSS 7.1)
• CVE-2026-44797 — Nautobot: Webhook definitions could be used for server-side request forgery (SSRF) (CVSS 8.5)
• CVE-2026-44796 — Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS) (CVSS 6.5)
• CVE-2026-44794 — Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference (CVSS 5.4)
• CVE-2026-34203 — Nautobot: Management of users via REST API does not apply configured password validators (CVSS 4.3)
• CVE-2025-49143 — Nautobot may allows uploaded media files to be accessible without authentication (CVSS 5.9)
• CVE-2025-49142 — Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating (CVSS 7.1)
• CVE-2024-36112 — Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects (CVSS 6.5)
• CVE-2024-34707 — Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages (CVSS 4.8)
• CVE-2024-32979 — Reflected Cross-site Scripting potential in all object list views in Nautobot (CVSS 6.1)
• CVE-2024-29199 — Unauthenticated views may expose information to anonymous users (CVSS 5.3)
• CVE-2024-23345 — Nautobot has XSS potential in rendered Markdown fields (CVSS 5.4)
• CVE-2023-51649 — Nautobot missing object-level permissions enforcement when running Job Buttons (CVSS 4.3)
• CVE-2023-50263 — Nautobot allows unauthenticated db-file-storage views (CVSS 5.3)
• CVE-2023-48705 — nautobot has XSS potential in custom links, job buttons, and computed fields (CVSS 5.4)
• CVE-2023-46128 — Exposure of hashed user passwords via REST API in Nautobot (CVSS 6.5)
• CVE-2023-25657 — Remote code execution in Jinja2 template rendering in Nautobot (CVSS 9.8)