Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group records (`extras.view_dynamicgroup` permission) can use the Dynamic Group detail UI
Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group records (extras.view_dynamicgroup permission) can use the Dynamic Group detail UI view (/extras/dynamic-groups/<uuid>/) and/or the members REST API view (/api/extras/dynamic-groups/<uuid>/members/) to list the objects that are members of a given Dynamic Group. In versions of Nautobot between 1.3.0 (where the Dynamic Groups feature was added) and 1.6.22 inclusive, and 2.0.0 through 2.2.4 inclusive, Nautobot fails to restrict these listings based on the member object permissions - for example a Dynamic Group of Device objects will list all Devices that it contains, regardless of the user's dcim.view_device permissions or lack thereof. This issue has been fixed in Nautobot versions 1.6.23 and 2.2.5. Users are advised to upgrade. This vulnerability can be partially mitigated by removing extras.view_dynamicgroup permission from users however a full fix will require upgrading.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | nautobot | >= 2.0.0, < 2.3.0b1 | 2.3.0b1 |
References
- https://github.com/nautobot/nautobot/security/advisories/GHSA-qmjf-wc2h-6x3q
- https://nvd.nist.gov/vuln/detail/CVE-2024-36112
- https://github.com/nautobot/nautobot/pull/5757
- https://github.com/nautobot/nautobot/pull/5762
- https://github.com/nautobot/nautobot/commit/3a63aa1327f943b2ac8452757ea2e4d403387ad6
- https://github.com/nautobot/nautobot/commit/4d1ff2abe2775b0a6fb16e6d1d503a78226a6f8e
- https://github.com/nautobot/nautobot
- https://github.com/pypa/advisory-database/tree/main/vulns/nautobot/PYSEC-2024-166.yaml
- https://github.com/advisories/GHSA-qmjf-wc2h-6x3q
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N- Weakness (CWE)
CWE-280- Platform
- Python (PyPI)
- Package
nautobot- Disclosed
- 28.05.2024
- Updated
- 11.10.2026 12:20
Sources and licenses
OSV / GitHub Advisory Database - GHSA-qmjf-wc2h-6x3q - CC BY 4.0
OSV / GitHub Advisory Database - PYSEC-2024-166 - PyPA Advisory Database; CC BY 4.0
Vulnerability history: nautobot
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 19
- First → latest
- 02.2023 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 9
- Medium 6
- Low 4
Disclosures per year
- 2023: 5
- 2024: 5
- 2025: 2
- 2026: 7
-
Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group records (`extras.view_dynamicgroup` permission) can use the Dynamic Group detail UI this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.