CVE-2026-83805 Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs
Attackers can bypass approval workflows to self-approve and activate scheduled jobs, leading to unauthorized privilege escalation and data modification.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-83805?
CVE-2026-83805 is a medium-severity missing authorization vulnerability in nautobot, published on 22 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does not enforce approver-group membership, change permission on the object under review, or the one-response-per-user restriction applied by the intended approve and deny actions. A user with only extras.add_approvalworkflowstageresponse can submit approved responses directly, while writable user and state fields permit responses to be attributed to arbitrary users. These forged responses can satisfy min_approvers, approve the workflow, and activate its gated ScheduledJob without a legitimate approver. This issue is fixed in version 3.1.8.
Which versions are affected by CVE-2026-83805?
3 open source packages ship an affected version, including nautobot.
| Package | Affected | Fixed in |
|---|---|---|
nautobot PyPI | From 3.0.0 | 3.1.8 |
nautobot PyPI | From 3.0.0 | 3.1.8 |
nautobot PyPI | From 3.0.0 | 3.1.8 |
How do I fix CVE-2026-83805?
Upgrade nautobot to 3.1.8 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-83805 being exploited?
There is no known exploitation of CVE-2026-83805 in the wild and no public exploit code.
Sources
Also known as GHSA-q4c5-2j6f-r476, PYSEC-2026-4111.