What is the CVSS score of CVE-2026-34203?

CVE-2026-34203 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-34203?

Yes, a patch is available for CVE-2026-34203. Update the affected software to the latest version immediately.

Python CVE-2026-34203

EUVD-2026-17598 LOW

Weak Password Requirements (CWE-521)

2026-03-31 GitHub_M

GHSA-xmpv-j7p2-j873

Python Brute Force Information Disclosure

2.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 01, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 19:47 euvd

EUVD-2026-17598

Analysis Generated

Mar 31, 2026 - 19:47 vuln.today

CVE Published

Mar 31, 2026 - 19:27 nvd

LOW 2.7

DescriptionGitHub Advisory

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to versions 2.4.30 and 3.0.10, user creation and editing via the REST API fails to apply the password validation rules defined by Django's AUTH_PASSWORD_VALIDATORS setting (which defaults to an empty list, i.e., no specific rules, but can be configured in Nautobot's nautobot_config.py to apply various rules if desired). This can potentially allow for the creation or modification of users to have passwords that are weak or otherwise do not comply with configured standards. This issue has been patched in versions 2.4.30 and 3.0.10.

AnalysisAI

Nautobot REST API user creation and modification endpoints bypass Django's configured password validation rules, allowing authenticated administrators to set or modify user passwords that fail to meet organizational security standards. Versions prior to 2.4.30 and 3.0.10 are affected; an authenticated admin with high privileges can create accounts with weak passwords despite configured AUTH_PASSWORD_VALIDATORS rules. CVSS score is 2.7 (low severity) due to requirement for authenticated administrative access; however, organizations with strict password policies relying on Nautobot's config-driven enforcement face integrity risk.

Technical ContextAI

Nautobot is a Python-based network source-of-truth and automation platform that exposes user management capabilities via REST API endpoints. The vulnerability stems from a failure to invoke Django's AUTH_PASSWORD_VALIDATORS during REST API user creation and modification operations, even though these validators are correctly applied through Nautobot's web UI and can be configured in nautobot_config.py to enforce rules such as minimum length, complexity requirements, or dictionary checks. CWE-521 (Weak Password Requirements) identifies the root cause: the REST API handlers do not call the same validation pipeline used by the web interface, creating a security logic gap. The vulnerability affects all versions prior to the patched releases 2.4.30 and 3.0.10.

RemediationAI

Upgrade Nautobot to version 2.4.30 or later (for 2.4.x deployments) or version 3.0.10 or later (for 3.0.x deployments). Both patched releases restore password validation enforcement in REST API user creation and modification endpoints by integrating Django's AUTH_PASSWORD_VALIDATORS into the API handlers, ensuring consistency with web UI behavior. No workarounds are available prior to patching; administrators cannot selectively disable REST API access to mitigate the gap. After upgrading, verify that any configured AUTH_PASSWORD_VALIDATORS in nautobot_config.py are properly applied to both UI and API user operations. Refer to the fix pull requests at https://github.com/nautobot/nautobot/pull/8778 and https://github.com/nautobot/nautobot/pull/8779 for technical implementation details.