CVE-2023-46128 Exposure of hashed user passwords via REST API in Nautobot

What is CVE-2023-46128?

CVE-2023-46128 is a medium-severity vulnerability in nautobot, published on 24 Oct 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 2.0.x, certain REST API endpoints, in combination with the `?depth=<N>` query parameter, can expose hashed user passwords as stored in the database to any authenticated user with access to these endpoints. The passwords are not exposed in plaintext. This vulnerability has been patched in version 2.0.3.

Weakness: CWE-312, CWE-200

Which versions are affected by CVE-2023-46128?

3 open source packages ship an affected version, including nautobot. It affects 1 product.

Products include Networktocode Nautobot.

How do I fix CVE-2023-46128?

Upgrade nautobot to 2.0.3 or later.

Is CVE-2023-46128 being exploited?

There is no known exploitation of CVE-2023-46128 in the wild and no public exploit code.

Other vulnerabilities in nautobot

• CVE-2026-44797 Nautobot: Webhook definitions could be used for server-side request forgery (SSRF) High 8.5
• CVE-2024-34707 Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages High 7.5
• CVE-2024-32979 Reflected Cross-site Scripting potential in all object list views in Nautobot High 7.5
• CVE-2023-25657 Remote code execution in Jinja2 template rendering in Nautobot High 7.5
• CVE-2026-44798 Nautobot: GitRepository.current_head field should not be writable through REST API High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r2hw-74xv-4gqp, PYSEC-2023-220.