https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T20:51:16.589402+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2024-29199 CVE-2024-29199 — Unauthenticated views may expose information to anonymous users 2026-10-02T20:51:16.591254+00:00

Affected: nautobot

Nautobot is a Network Source of Truth and Network Automation Platform. A number of Nautobot URL endpoints were found to be improperly accessible to unauthenticated (anonymous) users. These endpoints will not disclose any Nautobot data to an unauthenticated user unless the Nautobot configuration variable EXEMPT_VIEW_PERMISSIONS is changed from its default value (an empty list) to permit access to specific data by unauthenticated users. This vulnerability is fixed in 1.6.16 and 2.1.9.

 https://cve.radiocsirt.org/vuln/ghsa-m732-wvh2-7cq4 GHSA-m732-wvh2-7cq4 — Unauthenticated views may expose information to anonymous users 2026-10-02T20:51:16.591327+00:00

Affected: PyPI: nautobot

### Impact

A number of Nautobot URL endpoints were found to be improperly accessible to unauthenticated (anonymous) users, including the following:

- `/api/graphql/` (1) - `/api/users/users/session/` (Nautobot 2.x only; the only information exposed to an anonymous user is which authentication backend classes are enabled on this Nautobot instance) - `/dcim/racks/<uuid:pk>/dynamic-groups/` (1) - `/dcim/devices/<uuid:pk>/dynamic-groups/` (1) - `/extras/job-results/<uuid:pk>/log-table/` - `/extras/secrets/provider/<str:provider_slug>/form/` (the only information exposed to an anonymous user is the fact that a secrets provider with the given slug (e.g. `environment-variable` or `text-file`) is supported by this Nautobot instance) - `/ipam/prefixes/<uuid:pk>/dynamic-groups/` (1) - `/ipam/ip-addresses/<uuid:pk>/dynamic-groups/` (1) - `/virtualization/clusters/<uuid:pk>/dynamic-groups/` (1) - `/virtualization/virtual-machines/<uuid:pk>/dynamic-groups/` (1)

(1) These endpoints will not disclose any Nautobot data to an unauthenticated user unless the Nautobot configuration variable `EXEMPT_VIEW_PERMISSIONS` is changed from its default value (an empty list) to permit access to specific data by unauthenticated users.

Of these endpoints, the only one that poses any significant risk of sensitive information disclosure under normal Nautobot operation with a default configuration is `/extras/job-results/<uuid:pk>/log-table/`. This endpoint returns an HTML table containing all of the log…