Nautobot: Exposure of Hashed User Passwords via REST API
Summary
CVE-2023-46128: Nautobot vulnerable to exposure of hashed user passwords via REST API. Affects nautobot versions >= 2.0.0, < 2.0.3. Fixed in 2.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nautobot is an open-source platform that provides network automation and infrastructure management capabilities. It allows users to manage and monitor their network devices, racks, and other related components. However, a vulnerability has been discovered in Nautobot that exposes hashed user passwords through certain REST API endpoints.
Vulnerability Detail
The vulnerability exists in Nautobot 2.0.x versions, where specific REST API endpoints combined with the ?depth=<N> query parameter can expose hashed user passwords stored in the database. Although the passwords are not exposed in plaintext, any authenticated user with access to these endpoints can retrieve the hashed passwords. This issue does not affect Nautobot 1.x versions. The vulnerability can be triggered by various endpoints, including rack-reservations, job-results, notes, object-changes, scheduled-jobs, and permissions. Plugin REST API endpoints that reference the User model may also be impacted. The provided example demonstrates the presence of the password field in the nested users data.
How To Fix
Latest published version: 3.2.7 as of 23 Oct 2026
pip install --upgrade "nautobot==3.2.7"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.3
This is the first release that contains the fix.
pip install --upgrade "nautobot==2.0.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
While upgrading or applying the patch is the preferred solution, you can partially mitigate the vulnerability by denying user access to the impacted REST API endpoints mentioned above. However, this is not recommended as other endpoints may still expose the issue until patched.
Conclusion
Nautobot versions 2.0.x are vulnerable to the exposure of hashed user passwords through certain REST API endpoints. Upgrading to version 2.0.3 or later, or applying the provided patch, is highly recommended to mitigate this vulnerability. Denying user access to the impacted endpoints is not a recommended workaround as other endpoints may still be affected. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for nautobot →
FAQ
Nautobot 2.0.x versions are affected by this vulnerability. Nautobot 1.x versions are not affected.
No, the passwords are stored as hashed values and are not exposed in plaintext. However, the hashed passwords can still be used for certain attacks, such as offline cracking attempts.
Are there any known endpoints other than the ones mentioned that are impacted by this vulnerability?
The provided list of impacted endpoints is not exhaustive. Any endpoint that contains a nested reference to User objects and uses the ?depth=<N> query parameter can potentially expose the hashed passwords. Plugin REST API endpoints for models with a foreign key to the User model may also be affected.
While denying user access to the impacted REST API endpoints can partially mitigate the vulnerability, it is not recommended as other endpoints may still be vulnerable. Upgrading to Nautobot version 2.0.3 or later, or applying the provided patch, is the preferred solution.
There is no information available regarding active exploitation of this vulnerability at the moment. However, it is crucial to address the issue promptly to prevent any potential unauthorized access to hashed user passwords.
References
Related vulnerabilities
Recent vulnerabilities recorded for nautobot.
