CVE-2026-34203: 
Python vulnerability analysis and mitigation

CVE-2026-34203 is a weak password requirements vulnerability in Nautobot, a Network Source of Truth and Network Automation Platform, where user creation and editing via the REST API fails to apply Django's AUTH_PASSWORD_VALIDATORS password validation rules. This affects all Nautobot versions prior to 2.4.30 and versions 3.0.0 through 3.0.9. The vulnerability was disclosed on March 30–31, 2026, and patches were released simultaneously. It carries a CVSS v3.1 base score of 4.3 (Medium) per NVD, or 2.7 (Low) per the GitHub Security Advisory, classified as CWE-521 (Weak Password Requirements) (GitHub Advisory).

The root cause is a missing call to Django's validate_password() function within the UserSerializer.validate() method in nautobot/users/api/serializers.py. When a user is created or modified via the REST API, the serializer did not invoke the configured AUTH_PASSWORD_VALIDATORS, allowing any password — regardless of strength — to be accepted. The fix adds validate_password(validated_data["password"], user=self.instance) in the serializer's validate method, ensuring validators are enforced consistently with the admin UI path. Exploitation requires an authenticated attacker with REST API access and object-level permissions to create or modify user accounts (CWE-521) (GitHub Advisory, Commit 589f7ca).

Authenticated attackers with REST API access and appropriate object permissions can create or modify user accounts with passwords that violate organizational password policies — including trivially weak passwords. This does not directly expose confidential data or affect availability, but accounts with weak passwords are significantly more susceptible to brute-force, dictionary, or credential-stuffing attacks, which could lead to unauthorized access to Nautobot's network automation and source-of-truth data. The Nautobot admin UI was not affected by this bypass (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires authenticated access with specific object-level permissions (users.add_user or users.change_user) and a valid API token, significantly limiting the attack surface. The EPSS score is approximately 0.026% (0.000260), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Feedly).

1. Obtain API Access: Acquire a valid Nautobot REST API token for an account that has been granted users.add_user or users.change_user object permissions.
2. Identify Target Instance: Confirm the Nautobot instance is running a vulnerable version (< 2.4.30 or 3.0.0–3.0.9) and that AUTH_PASSWORD_VALIDATORS is configured with non-empty rules in nautobot_config.py.
3. Create or Modify User via REST API: Send a POST or PATCH request to the /api/users/users/ endpoint with a weak password that would normally be rejected by the configured validators:

   POST /api/users/users/ HTTP/1.1
   Authorization: Token <api_token>
   Content-Type: application/json
   
   {"username": "newuser", "password": "weak"}

4. Confirm Bypass: Verify the response returns HTTP 201 (Created) or 200 (OK), confirming the weak password was accepted without validation.
5. Leverage Weak Account: Use the newly created or modified account with its weak password for subsequent unauthorized access, potentially via brute-force or credential guessing if the account is later targeted (GitHub Advisory, Commit 589f7ca).

• Logs: Nautobot REST API access logs showing POST or PATCH requests to /api/users/users/ endpoints, particularly from accounts not typically associated with user management tasks.
• Application: Presence of user accounts with unusually simple or short passwords that would not comply with organizational password policy — identifiable through a post-incident password audit.
• Audit Trail: Nautobot change log entries showing user creation or password modification events attributed to API tokens rather than admin UI sessions, especially for accounts created between the vulnerability introduction and patching (GitHub Advisory).

Upgrade Nautobot to version 2.4.30 (for the 2.x branch) or 3.0.10 (for the 3.x branch), which add the missing validate_password() call in the REST API user serializer. As a workaround prior to patching, review and restrict which users have object permissions to create or modify user accounts via the REST API, and limit API token access accordingly. Additionally, audit all user accounts created or modified via the REST API before patching and rotate passwords for any accounts suspected of having weak passwords (GitHub Advisory, PR #8778, PR #8779).

The vulnerability was discovered by researcher morimori-dev and responsibly disclosed to the Nautobot team, who published the advisory and patches on March 30–31, 2026. No significant broader media coverage or notable community commentary beyond the GitHub advisory and standard CVE tracking databases has been identified.