CVE-2023-46128: Nautobot - Exposed Hashed User Passwords via REST API
Summary
CVE-2023-46128: Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. Affects nautobot across 2 version ranges.
< 1ce8e5c658a075c29554d517cd453675e5d40d71
>= 2.0.0, < 2.0.3
Fixed in 1ce8e5c658a075c29554d517cd453675e5d40d71. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. It provides network automation capabilities and relies on a database to store various data, including user passwords.
Vulnerability Detail
In Nautobot 2.0.x, certain REST API endpoints, when combined with the ?depth=<N> query parameter, can expose hashed user passwords stored in the database to any authenticated user with access to these endpoints. Although the passwords are not exposed in plaintext, the hashed passwords can still be a security risk if obtained by an attacker. This vulnerability has been assigned a CVSS score of 6.5, indicating a medium severity.
How To Fix
Latest published version: 3.2.7 as of 23 Oct 2026
pip install --upgrade "nautobot==3.2.7"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1ce8e5c658a075c29554d517cd453675e5d40d71
This is the first release that contains the fix.
pip install --upgrade "nautobot==1ce8e5c658a075c29554d517cd453675e5d40d71"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, Nautobot versions 2.0.0 to 2.0.2 are vulnerable to the exposure of hashed user passwords through certain REST API endpoints. Users should upgrade to version 2.0.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nautobot →
FAQ
Nautobot is a Network Automation Platform that enables automation of network management tasks through a web application built on Django and a database backend.
Nautobot versions 2.0.0 to 2.0.2 are affected by this vulnerability. Users of these versions should upgrade to version 2.0.3 or later.
An authenticated user with access to the affected REST API endpoints can exploit this vulnerability by including the ?depth=<N> query parameter in their requests. This will expose hashed user passwords stored in the database.
No, the passwords are not exposed in plaintext. However, the hashed passwords can still be a security risk if obtained by an attacker.
This vulnerability has been assigned a CVSS score of 6.5, indicating a medium severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for nautobot.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
