What’s Vulnerable › Vulnerabilities

CVE-2023-46128: Exposure of hashed user passwords via REST API in Nautobot

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-10-25 · updated 2026-06-17
• Weakness: CWE-200

Description

Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 2.0.x, certain REST API endpoints, in combination with the `?depth=<N>` query parameter, can expose hashed user passwords as stored in the database to any authenticated user with access to these endpoints. The passwords are not exposed in plaintext. This vulnerability has been patched in version 2.0.3.

Affected products

• nautobot: from 2.0.0 before 2.0.3 — fixed in 2.0.3

How to fix

Upgrade to a fixed version: nautobot 2.0.3. Check the vendor advisory for mitigations.

References

• https://github.com/nautobot/nautobot/commit/1ce8e5c658a075c29554d517cd453675e5d40d71
• https://github.com/nautobot/nautobot/pull/4692
• https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hw-74xv-4gqp
• https://github.com/nautobot/nautobot/commit/1ce8e5c658a075c29554d517cd453675e5d40d71
• https://github.com/nautobot/nautobot/pull/4692
• https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hw-74xv-4gqp

Get alerted when CVE-2023-46128 or the next vulnerability affects your stack