LoginSign Up
← Back to all sparks
N

Nautobot

INFRA · APIS
Velocity5.0

Network source of truth and network automation platform

networktocode.com/nautobot ↗

Nautobot's October releases are a permissions audit: objects users can't view kept leaking.

network-automationsecuritypermissionsbranch-backportsjinja-sandbox
◆Current state
Nautobot's 3.2 and 2.4 lines have shipped same-day security releases every two weeks since September. v3.2.8 and v2.4.45 lead with stored XSS fixes and a long run of cases where jobs, imports and REST related-object handling accepted or revealed objects the user could not view, including other users' API tokens. v3.2.7 and v2.4.44 closed a Jinja2 sandbox escape and added timeouts for regular-expression evaluation. v3.2.6 moved SSO login to HTTP POST, breaking bookmarked SSO URLs.
◆Where it's heading
Permissions were already the sustained theme in August, and the work has moved from Saved Views to the general paths every App relies on. New helpers such as restrict_queryset() and mock_wsgi_request() in the apps API, plus the fixes in WritableNestedSerializer, hand the same checks to App developers. The number of advisories per release points to a systematic review rather than a single report.
◆Prediction
Expect App authors to be pointed at those helpers, and further advisories in the same object-visibility class in the next paired releases. v3.2.8's warning that Pillow 13 cannot run on Python 3.10 makes that version's support the likely next removal.

◆Recent moves

  1. 8d ago

    v3.2.8: object-visibility fixes, stored XSS and permission helpers

    The fullest statement of the audit so far: object-visibility holes across jobs, imports and REST lookups, stored XSS, and new helpers so Apps can apply the same limits. The IP address merge tool also gains real object-level permission checks.

    View source ↗
  2. 8d ago

    v2.4.45: visibility and XSS fixes reach the 2.4 line

    The same object-visibility and stored XSS fixes on the 2.4 line, published about an hour before v3.2.8. Keeping the older branch at parity is part of this security round.

    View source ↗
  3. 22d ago

    v3.2.7: Jinja2 sandbox escape closed, regex timeouts added

    A template sandbox escape allowed arbitrary read queries, and a bypass exposed sensitive fields through a queryset projection. Regex timeouts close a separate denial-of-service path.

    View source ↗
  4. 22d ago

    v2.4.44: Jinja2 sandbox escape closed, regex timeouts added

    The sandbox escape and sensitive-field bypass fixes on the 2.4 line, with new App utilities for evaluating user-supplied regular expressions.

    View source ↗
  5. 1mo ago

    v3.2.6: SSO login moves to POST, job log permission fixed

    The SSO dependency upgrade turns the login action into a POST, breaking bookmarked SSO URLs, and permission gaps in cable trace and job logs are closed. It opens the run of security releases that follows.

    View source ↗
  6. 1mo ago

    v2.4.43: cable trace and job log permission fixes

    Cable trace and job log permission fixes on the 2.4 line, with the cable trace API changing its serialized fields as a result.

    View source ↗