Nautobot Security Update Addresses 2 Vulnerabilities
Tech GuruQuick Answer
Nautobot fixes two different authorization risks. CVE-2026-83801 is stored cross-site scripting in create/edit form help text, fixed in 2.4.37 and 3.1.8. CVE-2026-83805 affects the 3.x approval-workflow API and can activate a scheduled job without legitimate approval; its fix is 3.1.8. Match the deployed branch and relevant permissions before selecting a supported upgrade.
Confirm Scope And Apply The Supported Fix
What to do now: inventory Nautobot versions and grants to create/change Relationships, Module Families and approval-stage responses. Limit those grants to trusted operators while arranging the upgrade, and review unexpected content or approvals without rendering suspicious fields in a privileged production session.
Source recheck: October 2, 2026 UTC. The linked project advisories were checked for this revision; deployment applicability and successful remediation still require local evidence. Recheck the supported release before changing production.
Scope And Authority
| Product scope | Nautobot packages and release streams identified in the project advisories |
|---|---|
| Advisory | GHSA-56v6-2fhr-wxgq / GHSA-q4c5-2j6f-r476 |
| CVEs | CVE-2026-83801, CVE-2026-83805 |
| Authoritative release date | 2026-07-17 UTC (project advisory dates, not database ingestion) |
| Authority revision date | 2026-09-01, 2026-09-17 UTC (project advisory dates, not database ingestion) |
| Affected versions | CVE-2026-83801: nautobot <2.4.37 and >=3.0.0,<3.1.8; the project also warns that 1.x is end of life.CVE-2026-83805: >=3.0,<3.1.8. The approval issue is not stated to affect 2.x. |
| Fixed version | nautobot 2.4.37; nautobot 3.1.8 |
| CVSS base score | 5.4 / 6.4 (CVSS v3) |
| CVSS severity | Medium |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The XSS paths render a Relationship description or Module Family name as trusted help text; an affected form must be opened for the browser payload to run. The approval API issue is different: a user with extras.add_approvalworkflowstageresponse can bypass the intended approver checks, and approval can enable a scheduled job. Restricting who views forms alone does not address malicious stored content or the API authorization flaw.
What To Validate Now
- Inventory. Record the Nautobot branch, plugin dependencies, Relationship/Module Family editors, approval-response creation permissions and jobs gated by approval workflows.
- Establish applicability. Use the CVE-specific branch ranges above. Move end-of-life 1.x installations through a supported migration rather than assuming the 2.4.37 patch is a drop-in replacement.
- Remediate. Apply nautobot 2.4.37; nautobot 3.1.8 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. In staging, verify safe help-text rendering and permission denial using synthetic objects. Test unauthorized self-approval against a disposable job with no production actions, and confirm that ordinary authorized approvals still work.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
