Executive brief
Nautobot is a network source-of-truth and automation platform used to manage network infrastructure. A flaw in its REST API allows low-privileged users to bypass approval workflows by directly creating approval responses without proper authorization checks, and then automatically activating scheduled jobs that should require management approval. An attacker with minimal permissions can self-approve changes and enable background jobs without any legitimate approver involvement.
Technical details
This is an authorization bypass (CWE-285, CWE-639) in the ApprovalWorkflowStageResponse REST API endpoint. The generic create endpoint does not enforce approver membership checks, change permissions, or one-response-per-user limits that are present in the approve/deny actions. A user with only the extras.add_approvalworkflowstageresponse permission can POST approved responses directly via the REST API to bypass the min_approvers threshold. The serializer additionally exposes user and state fields as writable, allowing attackers to attribute responses to arbitrary users. Because approval workflows gate ScheduledJobs, successful self-approval cascades through ApprovalWorkflow.save() to on_workflow_approved(), which enables the target job for execution. Attack vector is network with low privilege requirement and no user interaction. Fixed in version 3.1.8.
Affected products
- Nautobot Nautobot >=3.0.0, <3.1.8
Timeline
- 2026-09-22: disclosed: Published to GitHub Advisory Database
- 2026-09-22: patched: Fixed in Nautobot v3.1.8