CVE-2026-83801: Nautobot Stored XSS Vulnerability

CVE-2026-83801 Overview

CVE-2026-83801 is a stored Cross-Site Scripting (XSS) vulnerability in Nautobot, a Network Source of Truth and Network Automation Platform. Authenticated users with specific permissions can inject HTML or JavaScript into Relationship descriptions or Module Family names. Nautobot renders these values as form field help_text through Django's |safe filter without adequate neutralization. The payload executes in the browser session of any user who opens an affected create or edit form, including administrators and superusers. The issue affects versions prior to 2.4.37 and 3.1.8.

Critical Impact
Stored JavaScript executes in authenticated sessions of victims viewing affected forms, enabling actions on behalf of the victim, session or token theft, and privilege escalation up to superuser level.

Affected Products

Nautobot versions prior to 2.4.37
Nautobot versions prior to 3.1.8
Django render_field.html template rendering of Relationship and Module Family objects

Discovery Timeline

2026-09-22 - CVE-2026-83801 published to NVD
2026-09-23 - Last updated in NVD database
Fix released - Nautobot versions 2.4.37 and 3.1.8 published containing patches e6ff20d and f8a6246

Technical Details for CVE-2026-83801

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting flaw (CWE-79) in Nautobot's form rendering pipeline. A user holding extras.add_relationship or extras.change_relationship permission can persist HTML or JavaScript in a Relationship's description field. Similarly, a user with dcim.add_modulefamily or dcim.change_modulefamily permission can persist a payload in a Module Family name. When Nautobot builds create or edit forms for these object types, it assigns those attacker-controlled strings to the help_text attribute of form fields.

The Django template render_field.html then outputs help_text through the |safe filter, which marks the string as trusted and bypasses HTML autoescaping. Any authenticated user, including administrators, who later opens an affected form triggers execution of the stored script in their browser context.

Root Cause

The root cause is trust of user-supplied text as safe HTML. Nautobot applied Django's |safe filter to help_text under the assumption that only developers would populate it. Because Relationship descriptions and Module Family names flow into that same attribute, attacker-supplied content is rendered unescaped in the DOM.

Attack Vector

An attacker requires an authenticated account with one of the four listed permissions. The attacker creates or edits a Relationship description or a Module Family name containing a JavaScript payload. When a victim, such as a superuser, later opens a create or edit form referencing that object, the script executes with the victim's session. This enables session or CSRF token theft, forced administrative actions, and further privilege escalation.

python

# Patch excerpt from nautobot/dcim/forms.py (commit e6ff20d / f8a6246)
 from django.contrib.auth import get_user_model
 from django.core.exceptions import ValidationError
 from django.db.models import Q
+from django.utils.html import format_html
 from timezone_field import TimeZoneFormField

 from nautobot.circuits.models import Circuit, CircuitTermination, Provider
# Source: https://github.com/nautobot/nautobot/commit/e6ff20d50e0759135c6d278e7b2ceec56ed9b3c8
# The fix imports Django's format_html to safely escape user-controlled
# strings before they are assigned to form field help_text.

Detection Methods for CVE-2026-83801

Indicators of Compromise

Relationship objects whose description field contains <script>, onerror=, onload=, javascript:, or HTML tag characters.
Module Family objects whose name field contains HTML markup or JavaScript event handler substrings.
Audit log entries showing creation or modification of Relationship or Module Family objects by non-administrator accounts shortly before superuser session anomalies.
Unexpected outbound HTTP requests originating from administrator browsers immediately after opening a Nautobot create or edit form.

Detection Strategies

Query the Nautobot database for extras_relationship.description and dcim_modulefamily.name values matching HTML or script regex patterns.
Correlate object create and update events against user permissions to flag non-superusers exercising extras.change_relationship or dcim.change_modulefamily.
Inspect web server access logs for administrator sessions that make anomalous authenticated API calls (for example, user creation or token generation) immediately after loading form pages.

Monitoring Recommendations

Enable Nautobot's change logging and forward events to a central SIEM for correlation with browser and network telemetry.
Alert on new or modified Relationship and Module Family objects created by non-privileged accounts.
Monitor administrator sessions for token creation, permission changes, or user provisioning actions that follow a form view event.

How to Mitigate CVE-2026-83801

Immediate Actions Required

Upgrade Nautobot to version 2.4.37 on the 2.4.x branch or 3.1.8 on the 3.1.x branch.
Audit existing Relationship.description and ModuleFamily.name values for HTML or JavaScript content and sanitize or remove offending records before granting administrators access to their forms.
Review recent grants of extras.add_relationship, extras.change_relationship, dcim.add_modulefamily, and dcim.change_modulefamily permissions and revoke where not required.
Rotate session cookies and API tokens for any account that may have viewed a poisoned form.

Patch Information

The issue is fixed in Nautobot v2.4.37 and Nautobot v3.1.8. The patches (e6ff20d and f8a6246) import Django's format_html helper and use it to escape user-controlled strings before they are assigned to form field help_text. See the GitHub Security Advisory GHSA-56v6-2fhr-wxgq for the full advisory.

Workarounds

Restrict the four affected permissions (extras.add_relationship, extras.change_relationship, dcim.add_modulefamily, dcim.change_modulefamily) to fully trusted operators until the upgrade is deployed.
Deploy a Content Security Policy (CSP) that disallows inline script execution to reduce the impact of stored HTML payloads.
Sanitize existing Relationship description and Module Family name fields directly in the database as an interim measure.

bash

# Upgrade Nautobot using pip to a patched release
pip install --upgrade 'nautobot==2.4.37'   # 2.4.x branch
# or
pip install --upgrade 'nautobot==3.1.8'    # 3.1.x branch

# Verify the installed version
nautobot-server --version