CVE-2025-49142: Nautobot secrets exposure and data manipulation via Jinja2 templating

Executive brief

Nautobot, a popular network source of truth and automation platform, is vulnerable to a security flaw in its templating engine. A user with limited access could potentially view sensitive system secrets or modify data they are not authorized to change. This could lead to unauthorized network configuration changes or the exposure of administrative credentials.

Technical details

Nautobot versions prior to 1.6.32 and 2.4.10 contain an improper neutralization of special elements in its Jinja2 templating implementation (CWE-1336). The vulnerability exists in features that utilize templating, such as computed fields, custom links, and job buttons. An attacker with low privileges can craft malicious Jinja2 templates to expose the values of defined Secrets or invoke Python APIs to modify internal data, effectively bypassing object-level permission checks. The issue stems from an insecure Jinja2 sandbox configuration. Patches are available in versions 1.6.32 and 2.4.10.

Affected products

• Network to Code Nautobot < 1.6.32, >= 2.0.0, < 2.4.10

Timeline

• 2025-06-10: disclosed
• 2025-06-10: advisory
• 2025-06-10: patched

References

• https://api.github.com/users/mzbroch
• https://github.com/mzbroch
• https://api.github.com/users/mzbroch/gists%7B/gist_id%7D
• https://api.github.com/users/mzbroch/repos
• https://avatars.githubusercontent.com/u/16935122?v=4
• https://api.github.com/users/mzbroch/events%7B/privacy%7D