Read the docs
TI-2025-38822 Aliases CVE-2025-62607GHSA-535g-62r7-cx6v

Nautobot Single Source of Truth (SSoT) has an unauthenticated ServiceNow configuration URL

Priority LOW 24CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-306.

Summary

Nautobot Single Source of Truth (SSoT) is an app for Nautobot. Prior to version 3.10.0, an unauthenticated attacker could access this page to view the Service Now public instance name e.g. companyname.service-now.com. This is considered low-value information. This does not expose the Secret, the Secret Name, or the Secret Value for the Username/Password for Service-Now.com. An unauthenticated member would not be able to change the instance name, nor set a Secret. There is not a way to gain access to other pages Nautobot through the unauthenticated Configuration page. This issue has been patched in version 3.10.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00294 22nd percentileScored 2026-11-07
Fix Fixed nautobot-app-ssot (nautobot): 3.10.0nautobot-ssot (PyPI): 3.10.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nautobotnautobot-app-ssotbefore 3.10.03.10.0Patch availableCNA
—nautobot-ssot (PyPI)before 3.10.03.10.0Patch availableGHSA-535g-62r7-cx6v
  • nautobot-app-ssot Vendornautobot Affected before 3.10.0 Fixed in 3.10.0 Patch available CNA
  • nautobot-ssot (PyPI) Vendor— Affected before 3.10.0 Fixed in 3.10.0 Patch available GHSA-535g-62r7-cx6v

Remediation

  • Fix · CNA nautobot-app-ssot (nautobot) Fixed in 3.10.0
  • Fix · GHSA-535g-62r7-cx6v nautobot-ssot (PyPI) Fixed in 3.10.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-62607
  2. 2026-10-03 Alias added: GHSA-535g-62r7-cx6v

References

Advisory 1

Other 4

  • TI-2023-10938 Remote code execution in Jinja2 template rendering in Nautobot CVSS 3.1CRITICAL 9.8
  • TI-2026-32681 Nautobot: Webhook definitions could be used for server-side request forgery (SSRF) CVSS 3.1HIGH 8.5
  • TI-2024-23004 Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages CVSS 3.1HIGH 7.5
  • TI-2024-21845 Reflected Cross-site Scripting potential in all object list views in Nautobot CVSS 3.1HIGH 7.5
  • TI-2024-15445 Nautobot has XSS potential in rendered Markdown fields CVSS 3.1HIGH 7.1
  • TI-2023-26544 nautobot has XSS potential in custom links, job buttons, and computed fields CVSS 3.1HIGH 7.1
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences