Read the docs

nautobot

Records21All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high6CVSS 7.0–8.9

Exploited now

nautobot records in CISA KEV

No nautobot vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Nautobot-plugin-device-onboarding 1 record LOW

Records

21 records

TI-2024-15445 CVE-2024-23345 · GHSA-v4xv-795h-rv4h

Nautobot has XSS potential in rendered Markdown fields

Priority LOW 32

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application.

CVSS 3.1HIGH 7.1 Network Low privileges User interaction EPSS 0.00433 Published 2024-01-22 Fixed in 2.1.2, 1.6.10 CWE-79
TI-2023-26544 CVE-2023-48705 · GHSA-cf9f-wmhp-v4pr

nautobot has XSS potential in custom links, job buttons, and computed fields

Priority LOW 32

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application All users of Nautobot versions earlier than 1.6.6 or 2.0.5 are potentially affected by a cross-site scripting vulnerability…

CVSS 3.1HIGH 7.1 Network Low privileges User interaction EPSS 0.00543 Published 2023-11-22 Fixed in 1.6.6, 2.0.5 CWE-79
TI-2023-24770 CVE-2023-46128 · GHSA-r2hw-74xv-4gqp

Exposure of hashed user passwords via REST API in Nautobot

Priority LOW 30

Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00667 Published 2023-10-24 Fixed in 2.0.3 CWE-200
TI-2023-26539 CVE-2023-48700 · GHSA-qf3c-rw9f-jh7v

Clear Text Credentials Exposed via Onboarding Task

Priority LOW 29

The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libraries to simplify the onboarding process of a new device into Nautobot down to, in many cases, an IP Address and a Location.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00414 Published 2023-11-21 Fixed in 3.0.0 CWE-256
TI-2026-57730 CVE-2026-83805 · GHSA-q4c5-2j6f-r476

Improper authorization in nautobot

Priority LOW 28

Nautobot is a Network Source of Truth and Network Automation Platform.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00294 Published 2026-09-22 Fixed in 3.1.8 CWE-285
TI-2023-27490 CVE-2023-50263 · GHSA-75mc-3pjc-727q

Nautobot allows unauthenticated db-file-storage views

Priority LOW 25

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00748 Published 2023-12-12 Fixed in 1.6.7, 2.0.6 CWE-200
TI-2026-32678 CVE-2026-44794 · GHSA-wpxj-44w3-2j6x

Missing authorization in nautobot

Priority LOW 24

Nautobot is a Network Source of Truth and Network Automation Platform.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00177 Published 2026-05-28 Fixed in 3.1.2, 2.4.33 CWE-862
Open these records in search →