CVE-2026-34203
Nautobot is a Network Source of Truth and Network Automation Platform. Prior to versions 2.4.30 and 3.0.10, user creation and editing via the REST API fails to apply the password validation rules defined by Django's AUTH_PASSWORD_VALIDATORS setting (which defaults to an empty list, i.e., no specific rules, but can be configured in Nautobot's nautobot_config.py to apply various rules if desired). This can potentially allow for the creation or modification of users to have passwords that are weak or otherwise do not comply with configured standards. This issue has been patched in versions 2.4.30 and 3.0.10.
Scoring
- Severity
- LOW
- CVSS base score
- 2.7
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
- EPSS probability
- 0.24%
- CWE
- CWE-521
- Published
- 2026-03-31
- Last modified
- 2026-03-31
Affected products
- nautobot nautobot
- nautobot nautobot
Weakness type
Related vulnerabilities
- CVE-2026-85216 — MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials
- CVE-2026-19293 — SMP security request
- CVE-2026-12504 — Loytec LINX firmware: Improper Authentication in PAM configuration
- CVE-2026-56577 — HCL MyCloud affected by Weak Password Policy
- CVE-2026-35097 — Weak Password Requirements in KTM System e-BOK
- CVE-2026-11493 — Tenda AC15 Samba smb.conf weak password
- CVE-2024-40684 — IBM Operations Analytics - Log Analysis is affected by Weak Password Policy and Inadequate Account Lockout Mechanism
- CVE-2026-9394 — Besen BS20 EV Charging Station Bluetooth Low Energy weak password