EXECUTIVE SUMMARY:
Multiple vulnerabilities have been identified in Nautobot which is a product used for network automation. The overall risk and impact of these vulnerabilities is considered medium to high and affects various components within the system.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
Multiple vulnerabilities have been identified in Nautobot which is a product used for network automation. The overall risk and impact of these vulnerabilities is considered medium to high and affects various components within the system.[emaillocker id="1283"]
CVE-2026-83801 (CVSS 5.4 — Medium): A stored cross-site scripting (XSS) vulnerability exists in the object create/edit form help text of Nautobot due to a user-controlled model field being assigned verbatim to a form field's `help_text`, which is rendered with Django's `|safe` filter, bypassing auto-escaping. This allows an attacker to execute scripts in the browser of any user who opens an affected create or edit form.
CVE-2026-83805 (CVSS 6.4 — Medium): An authorization bypass vulnerability exists in the approval workflow REST API of Nautobot allowing self-approval and unauthorized activation of scheduled jobs through approve/deny actions due to missing checks on the ApprovalWorkflowStageResponse creation endpoint and serializer exposure of writable fields.
RECOMMENDATIONS:
REFERENCES:
The following reports contain further technical details:
https://github.com/advisories/GHSA-56v6-2fhr-wxgq
https://github.com/advisories/GHSA-q4c5-2j6f-r476