Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs

ImpactThis is an authorization bypass that escalates into unauthorized server-side job execution.1. Primary impact - self-approval: The approver checks approver-group membership, change permission on the object under review, one-response-per-user are enforced only in the approve/deny actions on...

Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

ImpactWhat kind of vulnerability is it? Who is impacted?It has two related instances that share the same root cause: a user-controlled model field is assigned verbatim to a form field's helptext, which is rendered with Django's |safe filter renderfield.html, bypassing auto-escaping.In both cases...

Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs

Impact This is an authorization bypass that escalates into unauthorized server-side job execution. 1. Primary impact - self-approval: The approver checks approver-group membership, change permission on the object under review, one-response-per-user are enforced only in the approve/deny actions on...

GHSA-Q4C5-2J6F-R476 Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs

Impact This is an authorization bypass that escalates into unauthorized server-side job execution. 1. Primary impact - self-approval: The approver checks approver-group membership, change permission on the object under review, one-response-per-user are enforced only in the approve/deny actions on...

GHSA-56V6-2FHR-WXGQ Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

Impact What kind of vulnerability is it? Who is impacted? It has two related instances that share the same root cause: a user-controlled model field is assigned verbatim to a form field's helptext, which is rendered with Django's |safe filter renderfield.html, bypassing auto-escaping. In both cas...

Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

Impact What kind of vulnerability is it? Who is impacted? It has two related instances that share the same root cause: a user-controlled model field is assigned verbatim to a form field's helptext, which is rendered with Django's |safe filter renderfield.html, bypassing auto-escaping. In both cas...

CVE-2026-83801

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.addrelationship or extras.changerelationship permission can store HTML or JavaScript in a Relationship description, and a user with dcim.addmodulefamily or dcim.changemodulefamily...

CVE-2026-83805

Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does not enforce approver-group membership, change permission on the object under review, or the one-response-per-user restriction applied by th...

CVE-2026-83805 Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs

Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does not enforce approver-group membership, change permission on the object under review, or the one-response-per-user restriction applied by th...

CVE-2026-83805

Nautobot versions 3.0.0 through 3.1.8 are vulnerable to an authorization bypass in the approval workflow REST API. The generic ApprovalWorkflowStageResponse create endpoint fails to enforce approver-group membership, object change permissions, or the one-response-per-user restriction. An attacker...

CVE-2026-83805 Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs

Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does not enforce approver-group membership, change permission on the object under review, or the one-response-per-user restriction applied by th...

CVE-2026-83805 Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs

Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does not enforce approver-group membership, change permission on the object under review, or the one-response-per-user restriction applied by th...

EUVD-2026-84815

Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does not enforce approver-group membership, change permission on the object under review, or the one-response-per-user restriction applied by th...

CVE-2026-83801 Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.addrelationship or extras.changerelationship permission can store HTML or JavaScript in a Relationship description, and a user with dcim.addmodulefamily or dcim.changemodulefamily...

CVE-2026-83801 Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.addrelationship or extras.changerelationship permission can store HTML or JavaScript in a Relationship description, and a user with dcim.addmodulefamily or dcim.changemodulefamily...

EUVD-2026-84814

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.addrelationship or extras.changerelationship permission can store HTML or JavaScript in a Relationship description, and a user with dcim.addmodulefamily or dcim.changemodulefamily...

CVE-2026-83801

Nautobot is vulnerable to Stored Cross-Site Scripting (XSS) in versions prior to 2.4.37 and 3.1.8 . The root cause is the lack of adequate neutralization when user-controlled values—specifically Relationship descriptions (requiring extras.add_relationship / extras.change_relationship) or Module F...

CVE-2026-83801 Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.addrelationship or extras.changerelationship permission can store HTML or JavaScript in a Relationship description, and a user with dcim.addmodulefamily or dcim.changemodulefamily...

CVE-2026-83801: Improper Neutralization of Input During Web Page Generation

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.addrelationship or extras.changerelationship permission can store HTML or JavaScript in a Relationship description, and a user with dcim.addmodulefamily or dcim.changemodulefamily...

PT-2026-97022

Name of the Vulnerable Software and Affected Versions Nautobot versions prior to 2.4.37 Nautobot versions prior to 3.1.8 Description Users with specific permissions can store HTML or JavaScript in a Relationship description or a Module Family name. Nautobot assigns these values to form field help...