CVE-2026-83805 nautobot CVE debrief

Who should care

Nautobot administrators and users with ApprovalWorkflowStageResponse permissions should assess exposure and verify remediation. Operators of Nautobot installations, security teams, and vulnerability management teams should review the vulnerability and implement necessary mitigations.

Why it matters

CVE-2026-83805 allows unauthorized users to submit approved responses in Nautobot, potentially activating ScheduledJobs without proper approval. Nautobot administrators should verify their installations and restrict access to the ApprovalWorkflowStageResponse create endpoint. The issue is fixed in version 3.1.8.

• Potential unauthorized activation of ScheduledJobs
• Bypass of legitimate approval processes
• Possible attribution of responses to arbitrary users
• Verification of user permissions and response restrictions is required

Technical summary

The generic ApprovalWorkflowStageResponse create endpoint in Nautobot versions 3.0.0 to 3.1.8 does not enforce approver-group membership, change permission on the object under review, or the one-response-per-user restriction. This allows users with only extras.add_approvalworkflowstageresponse permission to submit approved responses directly, which can satisfy min_approvers, approve the workflow, and activate its gated ScheduledJob without a legitimate approver.

Defensive priority

Medium

Recommended defensive actions

• Review and update Nautobot installations to version 3.1.8 or later
• Restrict access to the ApprovalWorkflowStageResponse create endpoint
• Monitor for suspicious activity related to ScheduledJobs
• Verify user permissions and response restrictions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Nautobot versions from 3.0.0 to 3.1.8. The issue is fixed in version 3.1.8. Evidence is limited to public CVE and NVD records, which indicate that the vulnerability allows unauthorized users to submit approved responses. Defenders should verify Nautobot installations and restrict access to the ApprovalWorkflowStageResponse create endpoint.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.