Executive brief
Nautobot, a network source of truth and automation platform, contains a vulnerability in its REST API regarding how it handles links between different types of data. An authorized user could create or update records that reference sensitive objects (such as specific network devices) even if they do not have permission to view those objects. This could allow a user to bypass intended access controls and associate data with infrastructure they should not be able to interact with.
Technical details
A missing authorization check (CWE-862) exists in the Nautobot REST API's handling of GenericForeignKey fields. When a user creates or updates a model containing a GenericForeignKey (such as ImageAttachment, Cable, or Device), the API fails to verify if the user has 'view' permissions for the target object being referenced. If an attacker knows the UUID of a target object they cannot normally access, they can successfully create a reference to it. This affects multiple core models and potentially third-party Nautobot Apps. The issue is resolved in versions 2.4.33 and 3.1.2 by implementing a general-purpose fix that ensures 'view' permissions are validated during object reference creation or modification.
Affected products
- Network to Code Nautobot < 2.4.33, >= 3.0.0a2, < 3.1.2
Timeline
- 2026-05-08: disclosed: Initial disclosure on GitHub
- 2026-05-13: advisory: GitHub Advisory published
- 2026-05-28: other: NVD publication date