Nautobot before versions 2.4.30 and 3.0.10 does not enforce the password validation rules defined in the AUTH_PASSWORD_VALIDATORS setting when creating or editing users through its REST API. This omission allows administrators or attackers to assign passwords that are weak or do not meet organizational standards, potentially exposing user accounts to brute‑force or credential‑stuffing attacks. The vulnerability is categorized as weakness in password policy enforcement (CWE‑521).

The affected product is Nautobot (Network Source of Truth and Network Automation Platform). All releases prior to 2.4.30 for the 2.x line and prior to 3.0.10 for the 3.x line are vulnerable. Systems running those versions and exposing the REST API for user management are at risk.

The CVSS score of 2.7 indicates a low severity, and the EPSS score of less than 1% suggests a low probability of widespread exploitation. However, anyone with access to the Nautobot REST API can create or modify user accounts, bypassing the configured password policies. The vulnerability is not listed in CISA’s KEV catalog, and no direct exploit is documented. Nonetheless, weak passwords could facilitate credential compromise for any user that logs in with the affected account.