nautobot has 10 CVEs on record between 2023 and 2026. 2 were published in the last 90 days. The median CVSS is 6.4 (medium). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.4
- Publish → KEV
- —
- Last 90 days
- 2 prev 0
Worst active — by depth score
CVE-2023-46128High· 7.7Nautobot vulnerable to exposure of hashed user passwords via REST API42CVE-2024-34707High· 7.5Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages41CVE-2024-32979High· 7.5nautobot has reflected Cross-site Scripting potential in all object list views41CVE-2024-23345High· 7.1XSS potential in rendered Markdown fields (comments, description, notes, etc.)39CVE-2026-83805Medium· 6.4Nautobot is a Network Source of Truth and Network Automation Platform35
nautobot vulnerabilities
CVEs affecting nautobot, newest first. Open any entry for full detail, references, and exploit status.
10 CVEsRSS
CVE-2026-83805Medium· 6.4Nautobot is a Network Source of Truth and Network Automation Platform
Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does not enforce approver-group membership, change permission on the object under re…
CVE-2026-83801Medium· 5.4Nautobot is a Network Source of Truth and Network Automation Platform
Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.add_relationship or extras.change_relationship permission can store HTML or JavaScript in a Relationship description, an…
CVE-2026-34203Low· 2.7Nautobot: Management of users via REST API does not apply configured password validators
Nautobot: Management of users via REST API does not apply configured password validators
CVE-2025-49143MediumNautobot may allows uploaded media files to be accessible without authentication
Nautobot may allows uploaded media files to be accessible without authentication
CVE-2024-34707High· 7.5Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages
Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages
CVE-2024-32979High· 7.5nautobot has reflected Cross-site Scripting potential in all object list views
nautobot has reflected Cross-site Scripting potential in all object list views
CVE-2024-29199Low· 3.7Unauthenticated views may expose information to anonymous users
Unauthenticated views may expose information to anonymous users
CVE-2024-23345High· 7.1XSS potential in rendered Markdown fields (comments, description, notes, etc.)
XSS potential in rendered Markdown fields (comments, description, notes, etc.)
CVE-2023-50263Low· 3.7Unauthenticated db-file-storage views
Unauthenticated db-file-storage views
CVE-2023-46128High· 7.7Nautobot vulnerable to exposure of hashed user passwords via REST API
Nautobot vulnerable to exposure of hashed user passwords via REST API