CVE-2026-34203

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to versions 2.4.30 and 3.0.10, user creation and editing via the REST API fails to apply the password validation rules defined by Django's AUTH_PASSWORD_VALIDATORS setting (which defaults to an empty list, i.e., no specific rules, but can be configured in Nautobot's nautobot_config.py to apply various rules if desired). This can potentially allow for the creation or modification of users to have passwords that are weak or otherwise do not comply with configured standards. This issue has been patched in versions 2.4.30 and 3.0.10.

CVSS v3 2.7 LOW

2.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/nautobot/nautobot/commit/589f7caf54124ad76bc9fcbb7bdcaa25627cd598	Patch
https://github.com/nautobot/nautobot/commit/d1ef3135aa02fa07de061e8c085f8cce425fe8c9	Patch
https://github.com/nautobot/nautobot/pull/8778	Issue Tracking Patch
https://github.com/nautobot/nautobot/pull/8779	Issue Tracking Patch
https://github.com/nautobot/nautobot/security/advisories/GHSA-xmpv-j7p2-j873	Mitigation Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:networktocode:nautobot::::::::
	cpe:2.3:a:networktocode:nautobot::::::::

History

No history.

Information

Published : 2026-03-31 20:16

Updated : 2026-07-24 20:10

NVD link : CVE-2026-34203

Mitre link : CVE-2026-34203

CVE.ORG link : CVE-2026-34203

JSON object : View

Products Affected

networktocode

nautobot

CWE

CWE-521

Weak Password Requirements

{"id": "CVE-2026-34203", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34203", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-31T20:29:54.867462Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nautobot", "product": "nautobot", "versions": [{"status": "affected", "version": "< 2.4.30"}, {"status": "affected", "version": ">= 3.0.0, < 3.0.10"}]}]}], "published": "2026-03-31T20:16:28.360", "references": [{"url": "https://github.com/nautobot/nautobot/commit/589f7caf54124ad76bc9fcbb7bdcaa25627cd598", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nautobot/nautobot/commit/d1ef3135aa02fa07de061e8c085f8cce425fe8c9", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nautobot/nautobot/pull/8778", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nautobot/nautobot/pull/8779", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-xmpv-j7p2-j873", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-521"}]}], "descriptions": [{"lang": "en", "value": "Nautobot is a Network Source of Truth and Network Automation Platform. Prior to versions 2.4.30 and 3.0.10, user creation and editing via the REST API fails to apply the password validation rules defined by Django's AUTH_PASSWORD_VALIDATORS setting (which defaults to an empty list, i.e., no specific rules, but can be configured in Nautobot's nautobot_config.py to apply various rules if desired). This can potentially allow for the creation or modification of users to have passwords that are weak or otherwise do not comply with configured standards. This issue has been patched in versions 2.4.30 and 3.0.10."}, {"lang": "es", "value": "Nautobot es una Fuente de Verdad de Red y Plataforma de Automatizaci\u00f3n de Red. Antes de las versiones 2.4.30 y 3.0.10, la creaci\u00f3n y edici\u00f3n de usuarios a trav\u00e9s de la API REST no aplica las reglas de validaci\u00f3n de contrase\u00f1as definidas por la configuraci\u00f3n AUTH_PASSWORD_VALIDATORS de Django (que por defecto es una lista vac\u00eda, es decir, sin reglas espec\u00edficas, pero puede configurarse en nautobot_config.py de Nautobot para aplicar varias reglas si se desea). Esto puede permitir potencialmente la creaci\u00f3n o modificaci\u00f3n de usuarios para que tengan contrase\u00f1as que sean d\u00e9biles o que de otro modo no cumplan con los est\u00e1ndares configurados. Este problema ha sido parcheado en las versiones 2.4.30 y 3.0.10."}], "lastModified": "2026-07-24T20:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:networktocode:nautobot:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C701138B-987A-4CC7-A01A-A9319DA16A51", "versionEndExcluding": "2.4.30"}, {"criteria": "cpe:2.3:a:networktocode:nautobot:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D3259E19-11F4-4DA7-8D25-919F7E9D0E90", "versionEndExcluding": "3.0.10", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}