{"cve":"CVE-2023-46128","nvd":{"published":"2023-10-25T18:17:36.607","modified":"2026-06-17T06:30:12.583","status":"Modified","description":"Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 2.0.x, certain REST API endpoints, in combination with the `?depth=<N>` query parameter, can expose hashed user passwords as stored in the database to any authenticated user with access to these endpoints. The passwords are not exposed in plaintext. This vulnerability has been patched in version 2.0.3.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5},"cwes":["CWE-312","CWE-200"],"references":["https://github.com/nautobot/nautobot/commit/1ce8e5c658a075c29554d517cd453675e5d40d71","https://github.com/nautobot/nautobot/pull/4692","https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hw-74xv-4gqp","https://github.com/nautobot/nautobot/commit/1ce8e5c658a075c29554d517cd453675e5d40d71","https://github.com/nautobot/nautobot/pull/4692"],"products":["networktocode:nautobot"],"source":"nvd","synced_at":"2026-10-19T21:40:11.519948003+00:00"},"epss":{"cve":"CVE-2023-46128","score":0.00667,"percentile":0.51902,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-r2hw-74xv-4gqp","url":"https://osv.dev/vulnerability/GHSA-r2hw-74xv-4gqp","summary":"Nautobot vulnerable to exposure of hashed user passwords via REST API","modified":"2026-09-10T03:49:24.724889923Z","packages":[{"ecosystem":"PyPI","name":"nautobot","purl":"pkg:pypi/nautobot","ranges":[">=2.0.0 <2.0.3"],"fixed":["2.0.3"]}]},{"id":"PYSEC-2023-220","url":"https://osv.dev/vulnerability/PYSEC-2023-220","summary":"","modified":"2023-11-08T04:13:40.821501Z","packages":[{"ecosystem":"PyPI","name":"nautobot","purl":"pkg:pypi/nautobot","ranges":[">=2.0.0 <2.0.3"],"fixed":["2.0.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}