CVE-2026-34203

Name: CVE-2026-34203
Creator: NVD / NIST
Published: 2026-03-31T20:16:28.36+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 4.3/10EPSS 0.24%

Last modified Jun 17, 2026

CVE-2026-34203 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. Nautobot is a Network Source of Truth and Network Automation Platform. Prior to versions 2.4.30 and 3.0.10, user creation and editing via the REST API fails to apply the password validation rules defined by Django's AUTH_PASSWORD_VALIDATORS setting (which defaults to an empty list, i.e., no specific rules, but can be configured in Nautobot's nautobot_config.py to apply various rules if desired). EPSS estimates a 0.24% chance of exploitation in the next 30 days.

Description

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to versions 2.4.30 and 3.0.10, user creation and editing via the REST API fails to apply the password validation rules defined by Django's AUTH_PASSWORD_VALIDATORS setting (which defaults to an empty list, i.e., no specific rules, but can be configured in Nautobot's nautobot_config.py to apply various rules if desired). This can potentially allow for the creation or modification of users to have passwords that are weak or otherwise do not comply with configured standards. This issue has been patched in versions 2.4.30 and 3.0.10.

Metrics

CVSS 3.1

4.3/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS Probability

0.24%

15.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-521

Affected Software

Vendor	Product	Versions
Networktocode	Nautobot	< 2.4.30
Networktocode	Nautobot	>= 3.0.0, < 3.0.10

References

https://github.com/nautobot/nautobot/commit/589f7caf54124ad76bc9fcbb7bdcaa25627cd598Patch
https://github.com/nautobot/nautobot/commit/d1ef3135aa02fa07de061e8c085f8cce425fe8c9Patch
https://github.com/nautobot/nautobot/pull/8778Issue Tracking, Patch
https://github.com/nautobot/nautobot/pull/8779Issue Tracking, Patch
https://github.com/nautobot/nautobot/security/advisories/GHSA-xmpv-j7p2-j873Mitigation, Patch, Vendor Advisory

Timeline

Published: Mar 31, 2026
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2026-34203?

How severe is CVE-2026-34203?

CVE-2026-34203 has a CVSS score of 4.3/10 (MEDIUM severity). The EPSS model estimates a 0.24% probability of exploitation in the next 30 days.

How do I fix CVE-2026-34203?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2026-34203?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST