CVE-2026-34203 json
Nautobot: Management of users via REST API does not apply configured password validators
published 7mo ago modified 3mo ago also EUVD-2026-17598 , GHSA-xmpv-j7p2-j873 , PYSEC-2026-2224
- cvss
- 2.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 17%
- public exploits
- 0
- none known
Summary
Nautobot is a Network Source of Truth and Network Automation Platform. Prior to versions 2.4.30 and 3.0.10, user creation and editing via the REST API fails to apply the password validation rules defined by Django's AUTH_PASSWORD_VALIDATORS setting (which defaults to an empty list, i.e., no specific rules, but can be configured in Nautobot's nautobot_config.py to apply various rules if desired). This can potentially allow for the creation or modification of users to have passwords that are weak or otherwise do not comply with configured standards. This issue has been patched in versions 2.4.30 and 3.0.10.
Patch / fix
- pypi nautobot 2.4.30, 3.0.10
- networktocode nautobot 2.4.30, 3.0.10
- github.com/nautobot/nautobot@589f7ca commit
- github.com/nautobot/nautobot@d1ef313 commit
- github.com/nautobot/nautobot#8778 pull request
- github.com/nautobot/nautobot#8779 pull request
- github.com/nautobot/nautobot/security/advisories/GHSA-xmpv-j7p2-j873 advisory
Is CVE-2026-34203 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 7mo ago
Exploit prediction
0.26% chance of exploitation in the next 30 days, higher than 17% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 2.7 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N |
| GitHub | 3.1 | 2.7 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| OSV | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | nautobot | <2.4.30 >=3.0.0, <3.0.10 |
2.4.30 3.0.10 |
Affected products
- nautobot nautobot
Classification
- Weakness
-
- CWE-521 Weak Password Requirements
References
-
github.com
/nautobot/nautobot/pull/8778
web, issue-tracking, patch
-
github.com
/nautobot/nautobot/pull/8779
web, issue-tracking, patch
-
github.com
/nautobot/nautobot/commit/589f7caf54124ad76bc9fcbb7bdcaa25627cd598
web, patch
-
github.com
/nautobot/nautobot/commit/d1ef3135aa02fa07de061e8c085f8cce425fe8c9
web, patch
-
github.com
/nautobot/nautobot/security/advisories/GHSA-xmpv-j7p2-j873
web, mitigation, patch, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-34203
advisory
-
github.com
/nautobot/nautobot
package
Sources
- CVE List CVE-2026-34203
- GitHub Advisory GHSA-xmpv-j7p2-j873
- NVD CVE-2026-34203
- OSV PYSEC-2026-2224
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.