Nautobot allows unauthenticated db-file-storage views
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-306.
Summary
Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 1.x and 2.0.x prior to 1.6.7 and 2.0.6, the URLs `/files/get/?name=...` and `/files/download/?name=...` are used to provide admin access to files that have been uploaded as part of a run request for a Job that has FileVar inputs. Under normal operation these files are ephemeral and are deleted once the Job in question runs. In the default implementation used in Nautobot, as provided by `django-db-file-storage`, these URLs do not by default require any user authentication to access; they should instead be restricted to only users who have permissions to view Nautobot's `FileProxy` model instances. Note that no URL mechanism is provided for listing or traversal of the available file `name` values, so in practice an unauthenticated user would have to guess names to discover arbitrary files for download, but if a user knows the file name/path value, they can access it without authenticating, so we are considering this a vulnerability. Fixes are included in Nautobot 1.6.7 and Nautobot 2.0.6. No known workarounds are available other than applying the patches included in those versions.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nautobot | nautobot | 1.1.0 to before 1.6.7; 2.0.0 to before 2.0.6 | 1.6.7, 2.0.6 | Patch available | CNA |
| — | nautobot (PyPI) | 1.1.0 to before 1.6.7 | 1.6.7 | Patch available | GHSA-75mc-3pjc-727q |
| — | nautobot (PyPI) | 2.0.0 to before 2.0.6 | 2.0.6 | Patch available | GHSA-75mc-3pjc-727q |
- nautobot Vendornautobot Affected 1.1.0 to before 1.6.7; 2.0.0 to before 2.0.6 Fixed in 1.6.7, 2.0.6 Patch available CNA
- nautobot (PyPI) Vendor— Affected 1.1.0 to before 1.6.7 Fixed in 1.6.7 Patch available GHSA-75mc-3pjc-727q
- nautobot (PyPI) Vendor— Affected 2.0.0 to before 2.0.6 Fixed in 2.0.6 Patch available GHSA-75mc-3pjc-727q
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:networktocode:nautobot:*:*:*:*:*:*:*:* | 1.1.0 to before 1.6.7; 2.0.0 to before 2.0.6 | Vulnerable | Networktocode |
- cpe:2.3:a:networktocode:nautobot:*:*:*:*:*:*:*:* Versions 1.1.0 to before 1.6.7; 2.0.0 to before 2.0.6 Vulnerable ·Networktocode
Remediation
- Fix · CNA nautobot (nautobot) Fixed in 1.6.7, 2.0.6
- Fix · GHSA-75mc-3pjc-727q nautobot (PyPI) Fixed in 1.6.7 Advisory →
- Fix · GHSA-75mc-3pjc-727q nautobot (PyPI) Fixed in 2.0.6 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-50263
- 2026-10-03 Alias added: GHSA-75mc-3pjc-727q
References
Patch 5
- https://github.com/nautobot/nautobot/security/advisories/GHSA-75mc-3pjc-727q
- https://github.com/nautobot/nautobot/pull/4959
- https://github.com/nautobot/nautobot/pull/4964
- https://github.com/nautobot/nautobot/commit/458280c359a4833a20da294eaf4b8d55edc91cee
- https://github.com/nautobot/nautobot/commit/7c4cf3137f45f1541f09f2f6a7f8850cd3a2eaee
More nautobot vulnerabilities
- TI-2023-10938 Remote code execution in Jinja2 template rendering in Nautobot CVSS 3.1CRITICAL 9.8
- TI-2026-32681 Nautobot: Webhook definitions could be used for server-side request forgery (SSRF) CVSS 3.1HIGH 8.5
- TI-2024-23004 Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages CVSS 3.1HIGH 7.5
- TI-2024-21845 Reflected Cross-site Scripting potential in all object list views in Nautobot CVSS 3.1HIGH 7.5
- TI-2024-15445 Nautobot has XSS potential in rendered Markdown fields CVSS 3.1HIGH 7.1
- TI-2023-26544 nautobot has XSS potential in custom links, job buttons, and computed fields CVSS 3.1HIGH 7.1
Sources
- CVE-2023-50263 · CVE Program
- CVE-2023-50263 · NVD
- FIRST EPSS
- GHSA-75mc-3pjc-727q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences