Hoch

Nautobot vulnerable to exposure of hashed user passwords via REST API

Veröffentlicht: 24.10.2023
Aktualisiert: 11.10.2026 15:17

Impact

In Nautobot 2.0.x, certain REST API endpoints, in combination with the ?depth=<N> query parameter, can expose hashed user passwords as stored in the database to any authenticated user with access to these endpoints.

The passwords are not exposed in plaintext. Nautobot 1.x is not affected by this vulnerability.

Example:

GET /api/users/permissions/?depth=1

HTTP 200 OK
API-Version: 2.0
Allow: GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "count": 1,
    "next": null,
    "previous": null,
    "results": [
        {
            "id": "28ea85e4-5039-4389-94f1-9a3e1c787149",
            "object_type": "users.objectpermission",
            "display": "Run Job",
            "url": "http://localhost:8080/api/users/permissions/28ea85e4-5039-4389-94f1-9a3e1c787149/",
            "natural_slug": "run-job_28ea",
            "object_types": [
                "extras.job"
            ],
            "name": "Run Job",
            "description": "",
            "enabled": true,
            "actions": [
                "run",
                "view"
            ],
            "constraints": null,
            "groups": [
                {
                    "id": 1,
                    "object_type": "auth.group",
                    "display": "A Group",
                    "url": "http://localhost:8080/api/users/groups/1/",
                    "natural_slug": "a-group_1",
                    "name": "A Group"
                }
            ],
            "users": [
                {
                    "id": "e73288e2-1326-4bfb-8fea-041290dd7473",
                    "object_type": "users.user",
                    "display": "admin",
                    "url": "http://localhost:8080/api/users/users/e73288e2-1326-4bfb-8fea-041290dd7473/",
                    "natural_slug": "admin_e732",
                    "password": "pbkdf2_sha256$260000$jQb7hA48HYJ0MLWQgOZiBl$b72+gz6SpZiRpxceRQfT5Zv/aUac0eJ4NdBTZ8ECOow=",
                    "last_login": "2023-10-18T14:19:08.780857Z",
                    "is_superuser": true,
                    "username": "admin",
                    "first_name": "",
                    "last_name": "",
                    "email": "",
                    "is_staff": true,
                    "is_active": true,
                    "date_joined": "2023-10-18T14:18:55.854023Z",
                    "config_data": {}
                }
            ]
        }
    ]
}

Note the "password" field present in the nested "users" data.

This information is not exposed during direct access to the /api/users/users/ endpoint, but can be exposed through any endpoint which contains a nested reference to User object(s) when an appropriate ?depth=<N> query parameter is specified. Known impacted endpoints include:

/api/dcim/rack-reservations/?depth=1(or any greater depth value)
/api/extras/job-results/?depth=1 (or any greater depth value)
/api/extras/notes/?depth=1 (or any greater depth value)
/api/extras/object-changes/?depth=1 (or any greater depth value)
/api/extras/scheduled-jobs/?depth=1 (or any greater depth value)
/api/users/permissions/?depth=1 (or any greater depth value)

but this is not necessarily an exhaustive list.

Plugin REST API endpoints for any models with a foreign key to the User model may also be impacted by this issue.

The patch identified below mitigates the issue for both Nautobot core REST APIs and plugin REST APIs; no code change in plugins is required to address this issue.

Patches

Refer to https://github.com/nautobot/nautobot/pull/4692 for the patch that resolved this issue.

Workarounds

Upgrading to v2.0.3 or later, or applying the above patch, is the preferred workaround for this issue; while it could also be partially mitigated by updating permissions to deny user access to the above list of impacted REST API endpoints, that is not recommended as other endpoints may also expose this issue until patched.

References

https://github.com/nautobot/nautobot/pull/4692

Betroffene Software

Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.

Plattform	Paket	Anfällige Versionen	Behoben in
Python (PyPI)	nautobot	>= 2.0.0, < 2.0.3	2.0.3

Verweise

CVSS-Wert 7.7/10

CVSS-Vektor: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Schwäche (CWE): CWE-200, CWE-312, CWE-359
Plattform: Python (PyPI)
Paket: nautobot
Veröffentlicht: 24.10.2023
Aktualisiert: 11.10.2026 15:17

Quellen und Lizenzen

OSV / GitHub Advisory Database - PYSEC-2023-220 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-r2hw-74xv-4gqp - CC BY 4.0

Schwachstellenhistorie: nautobot

Alle veröffentlichten Schwachstellen dieses Pakets (Python (PyPI)), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.

Alle (19) im Archiv

Einträge insgesamt: 19
Erste → letzte: 02.2023 09.2026
Ohne Fix: 0
In Angriffen ausgenutzt: 0

Verteilung nach Schweregrad

Hoch 9
Mittel 6
Niedrig 4

Veröffentlichungen pro Jahr

2023: 5
2024: 5
2025: 2
2026: 7

13.05.2026

Nautobot: GitRepository.current_head field should not be writable through REST API

Hoch · 7.1 CVE-2026-44798 >= 3.0.0a2, < 3.1.2, < 2.4.33 3.1.2, 2.4.33
13.05.2026

Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)

Hoch · 8.5 CVE-2026-44797 >= 3.0.0a2, < 3.1.2, < 2.4.33 3.1.2, 2.4.33
10.06.2025

Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configur

Hoch · 7.1 CVE-2025-49142 < 1.6.32, >= 2.0.0, < 2.4.10 1.6.32, 2.4.10
13.05.2024

Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages

Hoch · 7.5 CVE-2024-34707 < 1.6.22, >= 2.0.0, < 2.2.4 1.6.22, 2.2.4
01.05.2024

nautobot has reflected Cross-site Scripting potential in all object list views

Hoch · 7.5 CVE-2024-32979 >= 1.5.0, < 1.6.20, >= 2.0.0, < 2.2.3 1.6.20, 2.2.3
23.01.2024

XSS potential in rendered Markdown fields (comments, description, notes, etc.)

Hoch · 7.1 CVE-2024-23345 >= 2.0.0, < 2.1.2, < 1.6.10 2.1.2, 1.6.10
22.11.2023

Cross-site Scripting potential in custom links, job buttons, and computed fields

Hoch · 7.1 CVE-2023-48705 < 1.6.6, >= 2.0.0, < 2.0.5 1.6.6, 2.0.5
24.10.2023

Nautobot vulnerable to exposure of hashed user passwords via REST API dieser Eintrag

Hoch · 7.7 CVE-2023-46128 >= 2.0.0, < 2.0.3 2.0.3
21.02.2023

Nautobot vulnerable to remote code execution via Jinja2 template rendering

Hoch · 7.5 CVE-2023-25657 < 1.5.7 1.5.7

Erkennen Sie Schwachstellen in Ihrer Anwendung

Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.

Anwendung verbinden