← Voltar para CVEs

CVE-2026-34203

LOW

2.7

Descricao

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to versions 2.4.30 and 3.0.10, user creation and editing via the REST API fails to apply the password validation rules defined by Django's AUTH_PASSWORD_VALIDATORS setting (which defaults to an empty list, i.e., no specific rules, but can be configured in Nautobot's nautobot_config.py to apply various rules if desired). This can potentially allow for the creation or modification of users to have passwords that are weak or otherwise do not comply with configured standards. This issue has been patched in versions 2.4.30 and 3.0.10.

Detalhes CVE

Pontuacao CVSS v3.12.7

SeveridadeLOW

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosHIGH

Interacao do usuarioNONE

Publicado3/31/2026

Ultima modificacao4/1/2026

Fontenvd

Avistamentos honeypot0

Fraquezas (CWE)

CWE-521

Referencias

https://github.com/nautobot/nautobot/commit/589f7caf54124ad76bc9fcbb7bdcaa25627cd598(security-advisories@github.com)

https://github.com/nautobot/nautobot/commit/d1ef3135aa02fa07de061e8c085f8cce425fe8c9(security-advisories@github.com)

https://github.com/nautobot/nautobot/pull/8778(security-advisories@github.com)

https://github.com/nautobot/nautobot/pull/8779(security-advisories@github.com)

https://github.com/nautobot/nautobot/security/advisories/GHSA-xmpv-j7p2-j873(security-advisories@github.com)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.