PT-2026-29333 · Nautobot · Nautobot

Morimori-Dev · Published 2026-03-31 · Updated 2026-04-01 · CVE-2026-34203

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nautobot versions prior to 2.4.30 Nautobot versions prior to 3.0.10

Description The application fails to enforce password validation rules defined by Django's AUTH PASSWORD VALIDATORS setting when creating or editing users via the REST API. This setting, configurable in nautobot config.py, can be used to apply various password complexity rules. The issue allows for the creation or modification of user accounts with weak or non-compliant passwords. User management through the admin UI correctly enforces password validation. The vulnerable component is the REST API used for user creation and editing. The affected API endpoints are those used for user creation and modification. The AUTH PASSWORD VALIDATORS variable is central to the issue.

Recommendations Versions prior to 2.4.30 should be updated to version 2.4.30 or later. Versions prior to 3.0.10 should be updated to version 3.0.10 or later. Review user permissions for accounts with access to create and modify user accounts via the REST API and restrict access as appropriate. Consider rotating passwords for user accounts suspected of having weak passwords.

Exploit

Fix

Weakness Enumeration

CWE-521

Related Identifiers

CVE-2026-34203

GHSA-XMPV-J7P2-J873

Affected Products

Nautobot

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34203.json · Exploit
• https://github.com/nautobot/nautobot/commit/589f7caf54124ad76bc9fcbb7bdcaa25627cd598 · Patch
• https://github.com/nautobot/nautobot/pull/8778 · Patch
• https://github.com/nautobot/nautobot/pull/8779 · Patch
• https://github.com/nautobot/nautobot/commit/d1ef3135aa02fa07de061e8c085f8cce425fe8c9 · Patch
• https://github.com/nautobot/nautobot/security/advisories/GHSA-xmpv-j7p2-j873 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34203 · Security Note
• https://osv.dev/vulnerability/GHSA-xmpv-j7p2-j873 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34203 · Vendor Advisory
• https://github.com/nautobot/nautobot · Note
• https://twitter.com/CVEnew/status/2039372150964945172 · Twitter Post
• https://twitter.com/infoflowcloud/status/2039374125739737347 · Twitter Post