CVE-2026-83805: Nautobot Authorization Bypass in Approval Workflow REST API
Summary
CVE-2026-83805: Impact This is an authorization bypass that escalates into unauthorized server-side job execution. Affects nautobot versions >= 3.0.0, < 3.1.8. Fixed in 3.1.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nautobot is an open-source network automation platform designed to help organizations manage their network infrastructure. It provides a robust set of features for managing devices, IP addresses, and other network-related resources. The platform includes an approval workflow system to manage changes and ensure that only authorized users can approve actions. However, a vulnerability has been identified that allows unauthorized users to bypass these approval mechanisms.
Vulnerability Detail
The vulnerability arises from an authorization bypass in the approval workflow REST API. Specifically, the checks for approver-group membership and permissions are only enforced during the 'approve' and 'deny' actions on the ApprovalWorkflowStage. The generic create endpoint for ApprovalWorkflowStageResponse does not enforce these checks, allowing users with only the 'extras.add_approvalworkflowstageresponse' permission to post approved responses directly. This can lead to self-approval and unauthorized activation of scheduled jobs, as the approval workflow can cascade to enable jobs without legitimate approval.
How To Fix
Latest published version: 3.2.7 as of 23 Oct 2026
pip install --upgrade "nautobot==3.2.7"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.8
This is the first release that contains the fix.
pip install --upgrade "nautobot==3.1.8"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict the 'extras.add_approvalworkflowstageresponse' permission so that untrusted users do not hold it. Approval responses should only be created through the stage 'approve' and 'deny' actions to prevent unauthorized access.
Conclusion
CVE-2026-83805 is a significant vulnerability in Nautobot that allows unauthorized users to bypass approval workflows, leading to potential unauthorized job execution. It is crucial to update to the patched version 3.1.8 or implement the recommended workarounds to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for nautobot →
FAQ
CVE-2026-83805 is a vulnerability in Nautobot that allows unauthorized users to bypass approval workflows and activate scheduled jobs.
If exploited, this vulnerability can lead to unauthorized job execution and changes in your network infrastructure without proper approval.
If upgrading is not possible, implement the recommended workaround by restricting permissions for the 'extras.add_approvalworkflowstageresponse' action.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check your application for vulnerabilities using the Vulert playground without any signup.
The CVSS score of CVE-2026-83805 is 6.4, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for nautobot.
