The vulnerability allows an attacker who can access the Nautobot REST API to create or edit users with passwords that bypass Django’s configured validation rules. This means users can be assigned passwords that are weak or do not meet the organization’s security policies, reducing overall credential strength.

All Nautobot installations running versions prior to 2.4.30 or 3.0.10 are affected. The issue appears in the default Network Source of Truth and Automation Platform provided by Nautobot and any deployments that rely on the REST API for user management.

The flaw carries a CVSS score of 2.7, categorizing it as low severity. An attacker needs authenticated access to the API to create or modify users, after which weak passwords can be enforced. No public exploits have been disclosed and the vulnerability is not listed in the known exploited vulnerabilities catalog. With the EPSS score unavailable, the likelihood of exploitation remains unclear, but the attack vector is straightforward within the API layer.