CVE-2026-83805: Nautobot authorization bypass in approval workflow REST API

CVE-2026-83805 · Severity: medium · CVSS 6.4 · Published 2026-09-22

Nautobot is a network source-of-truth and automation platform used to manage network infrastructure. A flaw in its REST API allows low-privileged users to bypass approval workflows by directly creating approval responses without proper authorization checks, and then automatically activating scheduled jobs that should require management approval. An attacker with minimal permissions can self-approve changes and enable background jobs without any legitimate approver involvement.

Technologies: nautobot (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-83805 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-83805 being exploited in the wild.
How severe is CVE-2026-83805?
Medium severity, with a CVSS score of 6.4, published 22 September 2026.
Which products and versions are affected?
nautobot (PyPI) >= 3.0.0, < 3.1.8, ECOSYSTEM:introduced=3.0.0,fixed=3.1.8.
Is there a fix for CVE-2026-83805?
Yes. nautobot (PyPI): upgrade to 3.1.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-83805 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-83805?
Check whether you run nautobot (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nautobot (PyPI): upgrade to 3.1.8 or later
    pip install "nautobot>=3.1.8"

Technical details

This is an authorization bypass (CWE-285, CWE-639) in the ApprovalWorkflowStageResponse REST API endpoint. The generic create endpoint does not enforce approver membership checks, change permissions, or one-response-per-user limits that are present in the approve/deny actions. A user with only the extras.add_approvalworkflowstageresponse permission can POST approved responses directly via the REST API to bypass the min_approvers threshold. The serializer additionally exposes user and state fields as writable, allowing attackers to attribute responses to arbitrary users. Because approval workflows gate ScheduledJobs, successful self-approval cascades through ApprovalWorkflow.save() to on_workflow_approved(), which enables the target job for execution. Attack vector is network with low privilege requirement and no user interaction. Fixed in version 3.1.8.

Affected products

  • Nautobot Nautobot >=3.0.0, <3.1.8

Identifiers

  • CVE-2026-83805
  • GHSA-q4c5-2j6f-r476
  • PYSEC-2026-4111

Timeline

  • 2026-09-22: disclosed: Published to GitHub Advisory Database
  • 2026-09-22: patched: Fixed in Nautobot v3.1.8

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.