Nautobot vulnerabilities
We track 4 vulnerabilities in Nautobot products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on May 28, 2026.
Latest Nautobot vulnerabilities
- 7.1 High severity
nautobot: Modification of Assumed-Immutable Data (MAID)
Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, a user with access to add/change a GitRepository record could use the REST API to directly set the current_head field on the record, which was not intended to be
- 8.5 High severity
nautobot: Server-Side Request Forgery
Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot's Webhook data model and associated feature set could be configured by users with sufficient access to perform requests to various hosts and IP addresses
- 7.1 High severity
nautobot: Improper Neutralization of Special Elements Used in a Template Engine
Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fiel
- 9.8 Critical severity
nautobot: Improper Control of Generation of Code
Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions earlier than 1.5.7 are impacted by a remote code execution vulnerability. Nautobot did not properly sandbox Jinja2 template rendering. In Nautobot 1.5.7 has e