CVE-2026-83801

Executive Summary

CVE-2026-83801 is a stored cross-site scripting (XSS) vulnerability in Nautobot, a Network Source of Truth and Network Automation Platform, present in all versions prior to 2.4.37 and 3.1.8. The flaw allows an authenticated user holding specific low-privileged permissions (extras.add_relationship / extras.change_relationship or dcim.add_modulefamily / dcim.change_modulefamily) to persist HTML or JavaScript that is later rendered through Django's |safe filter without adequate neutralization. When any authenticated user—including an administrator or superuser—opens an affected create or edit form, the stored payload executes in that victim's browser session.

Technical Analysis

Nautobot is a Django-based network automation and IPAM/DCIM platform. This vulnerability is a classic stored XSS (CWE-79) arising from an unsafe rendering path, not from network exposure or authentication bypass.

Mechanism, as described in the NVD entry:

• Two distinct attacker-controlled storage sinks exist:
  1. A Relationship description field, writable by a user with extras.add_relationship or extras.change_relationship permission.
  2. A Module Family name, writable by a user with dcim.add_modulefamily or dcim.change_modulefamily permission.
• In both cases, Nautobot assigns the stored value to a form field's help_text attribute.
• That help_text is rendered by the template render_field.html through Django's |safe filter, which explicitly disables HTML auto-escaping.
• Because the stored content is not adequately neutralized before being marked safe, embedded HTML or JavaScript is emitted verbatim into the DOM of the affected page.

The attack surface is any create or edit form that pulls one of the poisoned values into help_text. Critically, the payload is not confined to the attacker's own session: it executes in the browser session of any user who subsequently opens one of these forms, including privileged users. This makes the flaw a privilege-escalation vector rather than a simple self-XSS.

Two properties drive severity:

• Stored/persistent — the payload survives until the field is edited or removed, giving broad temporal reach.
• Cross-tenant/role reach — low-privileged editors can plant code that executes in high-privileged viewers' sessions, inverting the normal privilege model.

The root cause is the combination of a user-writable field, a presentation-layer help_text context (which developers often treat as trusted, developer-authored text), and an explicit |safe escape-hatch that assumes the content is safe to render as raw HTML.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is known for this CVE. The following chain is inferred strictly from the vulnerability class and the storage sinks named in the NVD description; no implementation details beyond those stated are asserted.

1) Reconnaissance / target identification An attacker identifies an internet- or intranet-exposed Nautobot instance (fingerprintable via its login page and API status endpoint; see Shodan dorks). The attacker requires an authenticated account with at least one of the four relevant permissions: extras.add_relationship, extras.change_relationship, dcim.add_modulefamily, or dcim.change_modulefamily. In many deployments these are granted to network engineers, integrators, or automation service accounts rather than only to administrators.

2) Triggering the flaw class Using the granted permission, the attacker creates or edits a Relationship (setting the description) or a Module Family (setting the name) and supplies crafted HTML/JavaScript content. Because the value is persisted to the datastore, this step is a one-time write. The malicious string is now resident.

3) Payload/execution method The stored value is assigned to a form field's help_text. Whenever a user opens a create or edit form that renders the affected field, render_field.html emits the help_text through Django's |safe filter, causing the stored markup and script to be interpreted by the browser rather than displayed as inert text. Execution therefore occurs in the victim's authenticated session — the defining characteristic of stored XSS.

4) Post-exploitation impact Because the script runs with the victim's session context, the attacker can:

• Perform actions in the application as the victim, including on behalf of an administrator or superuser.
• Steal session cookies or CSRF/API tokens to enable session or token theft.
• Use the compromised privileged session to escalate privileges further — e.g., grant the attacker's own account additional permissions, alter configuration, or pivot into connected automation/integration workflows.

The CVSS scope subscore (S:C) captures exactly this: a low-privileged attacker's vector produces security impact in a different security authority (the victim's account).

Impact Assessment

CVSS 3.1 base score: 5.4 (Medium) — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

• AV:N — the platform is routinely reached over the network.
• AC:L / PR:L — exploitation is straightforward once an authenticated low-privileged account exists.
• UI:R — impact materializes when a victim opens an affected form, which is a routine, low-effort action by administrators and engineers.
• S:C — one of the most important metrics here: a low-privileged compromise changes scope and affects resources beyond the attacker's authority (the victim's session).
• C:L / I:L / A:N — limited confidentiality and integrity impact per the vector; actions are bounded by the victim's privileges but can be chained, giving the impact a high ceiling.

Business impact. Nautobot is a Network Source of Truth — it accumulates authoritative data on devices, IP addressing, racks, modules, and automation intent. Compromise of an administrative session can therefore translate into manipulation of network configuration data and downstream automation, not merely website defacement. In environments where Nautobot drives Ansible/Nornado or API integration, integrity impact can extend into the managed network.

Blast radius. Bounded by the victim population that opens the affected Relationship/Module Family forms. Because administrators and superusers routinely work in these forms, the effective reach frequently includes the highest-privileged users in the deployment.

Severity framing. The CVSS score is 5.4 (not higher) primarily because confidentiality/integrity impacts are rated Limited and no availability impact is scored. However, the stored nature plus scope change means real-world outcomes can be substantially worse than the numeric score suggests, especially where the poisoned session belongs to a superuser.

Detection Guidance

Sigma Rule

title: Nautobot Stored XSS via Relationship Description or Module Family Name
id: 7f3b2a91-4c1e-4d8a-9b6f-1a2c3d4e5f60
status: experimental
description: Detects creation/update of Nautobot Relationship or Module Family objects containing HTML/JavaScript, the storage stage of CVE-2026-83801.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-83801
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: nautobot
  service: audit
detection:
  selection_endpoint:
    request_url|contains:
      - '/api/extras/relationships'
      - '/extras/relationships'
      - '/api/dcim/module-families'
      - '/dcim/module-families'
  selection_method:
    request_method:
      - POST
      - PUT
      - PATCH
  selection_payload:
    request_body|re: '(?i)(<script|javascript:|onerror\s*=|onload\s*=|onmouseover\s*=|onfocus\s*=|onclick\s*=|srcdoc\s*=|&#x?[0-9a-f]+;|%3cscript|<img[^>]*src)'
  condition: selection_endpoint and selection_method and selection_payload
falsepositives:
  - Legitimate descriptions containing harmless markup (rare)
level: high
tags:
  - attack.t1190
  - cwe.79

YARA Rule

rule CVE_2026_83801_Nautobot_Stored_XSS
{
    meta:
        description = "Detects HTML/JS payload patterns associated with Nautobot stored XSS (Relationship description / Module Family name)"
        cve = "CVE-2026-83801"
        cwe = "CWE-79"
        author = "Threat Intelligence"
        date = "2026-01-01"

    strings:
        $s1 = "<script" nocase
        $s2 = "</script>" nocase
        $s3 = "javascript:" nocase
        $s4 = "onerror=" nocase
        $s5 = "onload=" nocase
        $s6 = "onmouseover=" nocase
        $s7 = "onfocus=" nocase
        $s8 = "srcdoc=" nocase
        $s9 = "<img" nocase
        $s10 = "<svg" nocase

    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-83801 Nautobot Stored XSS Payload in Relationship/Module Family (Possible)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/relationships"; nocase; http.request_body; pcre:"/(?i)(<script|javascript:|onerror\\s*=|onload\\s*=|srcdoc\\s*=)/"; classtype:web-application-attack; reference:cve,2026-83801; metadata:created_at 2026_01_01, cve CVE-2026-83801; sid:90003801; rev:1;)

alert http any any -> any any (msg:"CVE-2026-83801 Nautobot Stored XSS Payload in Module Family (Possible)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/module-families"; nocase; http.request_body; pcre:"/(?i)(<script|javascript:|onerror\\s*=|onload\\s*=|srcdoc\\s*=)/"; classtype:web-application-attack; reference:cve,2026-83801; metadata:created_at 2026_01_01, cve CVE-2026-83801; sid:90003802; rev:1;)

Elastic Detection

sequence by user.name with maxspan=2m
  [ any where event.category == "web" and http.request.method in ("POST","PUT","PATCH")
      and http.request.body.text contains "extras/relationships"
      and (http.request.body.text contains "<script" or http.request.body.text contains "javascript:" or http.request.body.text contains "onerror=") ]
  [ any where event.category == "web" and http.request.method in ("POST","PUT","PATCH")
      and http.request.body.text contains "dcim/module-families"
      and (http.request.body.text contains "<script" or http.request.body.text contains "javascript:" or http.request.body.text contains "onerror=") ]

Splunk SPL Query

index=proxy OR index=web
| eval combined=lower(uri." ".body)
| where (match(uri, "(?i)/extras/relationships") OR match(uri, "(?i)/dcim/module-families"))
| where match(combined, "(?i)(<script|javascript:|onerror\s*=|onload\s*=|srcdoc\s*=|onmouseover\s*=)")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris values(user) as users by src_ip
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="web,nautobot,xss,">
  <rule id="1000381" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">/relationships|/module-families</field>
    <pcre2 field="request_body">(?i)(&lt;script|javascript:|onerror\s*=|onload\s*=|srcdoc\s*=)</pcre2>
    <description>CVE-2026-83801 - Possible Nautobot stored XSS payload submitted in Relationship/Module Family field</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_83801,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, workaround, or OSV package data was located for this CVE at the time of writing. The NVD description states the issue is fixed in Nautobot 2.4.37 and 3.1.8, but this must be independently verified against the vendor's release channels before treating it as authoritative — no patch evidence from tracked sources was found to corroborate it.

1) Immediate mitigations

• Restrict the vulnerable permissions. Audit and minimize grants of extras.add_relationship, extras.change_relationship, dcim.add_modulefamily, dcim.change_modulefamily, and the corresponding change permissions. Remove them from broad roles or integration/service accounts where not strictly required.
• Limit UI exposure. Reduce the number of users who routinely open affected create/edit forms, since victim interaction is the trigger (UI:R).
• Apply a compensating network control. Deploy the Suricata rules above at the ingress/WAF layer to flag HTML/JavaScript submitted to Relationship or Module Family endpoints.
• Content Security Policy. A strict CSP that disallows inline script and blocks unsafe inline event handlers (onerror=, onload=, etc.) would neutralize the execution primitive even where the injection lands. Confirm this against the Nautobot deployment before relying on it.
• Monitor for stored payloads. Sweep existing Relationship descriptions and Module Family names for HTML/JavaScript artifacts; any found indicate prior exploitation or accidental poisoning.

2) Patch / upgrade steps

• Upgrade to Nautobot 2.4.37 or 3.1.8 as stated in the NVD description, after verifying the fix in the vendor's release notes.
• Preserve a pre-upgrade configuration and data snapshot so that any stored malicious payloads encountered during upgrade can be reviewed and safely removed.
• Validate that no legitimate Relationship or Module Family content was inadvertently affected by any sanitization introduced with the fix (test in a staging environment first).

3) Long-term hardening

• Eliminate the pattern. Treat |safe on any user-influenced field as a code smell; help_text sourced from user-editable model fields should be rendered escaped or sanitized with an allow-list HTML sanitizer, never marked safe by default.
• Trust-boundary discipline. Ensure presentation templates distinguish developer-authored static text from user-authored content.
• RBAC review. Regularly re-audit what "low-privileged" permissions permit in Nautobot. The scope-change nature of this bug illustrates how a nominally minor permission can become a path to administrator session compromise.
• Defense in depth. Pair CSP, output encoding, and the WAF/IDS detections above so a future instance of this class does not depend solely on a single control.

References

• NVD — CVE-2026-83801: https://nvd.nist.gov/vuln/detail/CVE-2026-83801
• MITRE CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• Nautobot project (vendor) — check official release notes and security advisories for the 2.4.37 and 3.1.8 releases: https://github.com/nautobot/nautobot/releases
• CISA Known Exploited Vulnerabilities Catalog (not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild status: No public proof-of-concept, exploit code, Nuclei template, or CISA KEV listing exists for CVE-2026-83801 at the time of writing, and no associated threat-actor campaign is known. EPSS had not yet been scored by FIRST.org. Because this is a stored XSS affecting administrative sessions, defenders should not assume absence of public tooling implies absence of risk — internal or targeted exploitation remains plausible and may be detected first through the audit-log and content-scan detections above.