CVE-2026-83805

Executive Summary

CVE-2026-83805 is an improper authorization vulnerability in Nautobot, a Network Source of Truth and Network Automation Platform. From version 3.0.0 through 3.1.7, the generic ApprovalWorkflowStageResponse create endpoint fails to enforce approver-group membership, change permission on the object under review, or the one-response-per-user restriction. This allows a low-privileged authenticated user with only the extras.add_approvalworkflowstageresponse permission to forge approval responses, attribute them to arbitrary users, satisfy approval thresholds, and activate gated automation jobs without legitimate authorization.

Technical Analysis

Nautobot's approval workflow system is designed to enforce separation of duties: a user submitting a response to an ApprovalWorkflowStage should be validated against group membership, object-level change permissions, and a one-response-per-user constraint. The vulnerability arises because the generic create endpoint for ApprovalWorkflowStageResponse objects does not apply the same validation logic as the intended approve and deny actions.

Specifically, the endpoint:

• Does not verify that the requesting user belongs to the approver group defined for the workflow stage.
• Does not check whether the user has change permission on the object under review (the gated ScheduledJob or associated object).
• Does not enforce the one-response-per-user restriction, allowing multiple responses or responses from users who have already responded.

Additionally, the endpoint exposes writable user and state fields. An attacker can set the user field to an arbitrary user ID and set state to approved, creating a forged response attributed to another user. These forged responses are counted toward the min_approvers threshold. Once the threshold is met, the workflow transitions to approved, and the gated ScheduledJob is activated and executed.

The root cause is a missing authorization check (CWE-285) in the generic API create endpoint, which bypasses the business logic enforced by the dedicated approve/deny actions. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) indicates network exploitable, low complexity, low privileges required, no user interaction, scope changed, with low confidentiality and integrity impact.

Exploitation Scenarios

Note: No public PoC or exploit code is available. The following attack chain is inferred strictly from the NVD description and vulnerability class.

1. Reconnaissance/Target Identification: The attacker identifies a Nautobot instance (version 3.0.0–3.1.7) that uses approval workflows to gate ScheduledJobs. The attacker must have an authenticated account with at least the extras.add_approvalworkflowstageresponse permission. This permission may be granted to low-privileged users who are not intended approvers.

2. Triggering the Flaw: The attacker sends a crafted HTTP POST request to the generic create endpoint for ApprovalWorkflowStageResponse objects. The request includes a valid stage reference, a state field set to approved, and a user field set to the ID of a legitimate approver (or any user whose response would satisfy the threshold).

3. Payload/Execution Method: The payload is a JSON or form-encoded body containing the forged response data. Because the endpoint does not validate group membership, change permission, or the one-response-per-user rule, the response is accepted and persisted. The attacker can repeat this for multiple responses, attributing each to different users, until min_approvers is satisfied.

4. Post-Exploitation Impact: Once the forged responses satisfy min_approvers, the approval workflow advances to approved, and the associated gated ScheduledJob is activated. This may execute arbitrary automation tasks (e.g., network configuration changes, data collection, or job execution) with the privileges of the ScheduledJob, potentially leading to unauthorized changes, data exfiltration, or further compromise of the automation platform.

No public PoC is available; the attack chain is inferred from the vulnerability class.

Impact Assessment

Successful exploitation allows an authenticated low-privileged user to bypass approval workflows and activate gated ScheduledJobs without legitimate authorization. This undermines the separation-of-duties control, enabling unauthorized automation execution. The CVSS score is 6.4 (Medium), with Scope Changed (S:C), reflecting that the vulnerable component (approval workflow) impacts resources beyond its security scope (the ScheduledJob and its downstream effects). Confidentiality and Integrity impacts are Low; Availability impact is None. The blast radius depends on the privileges and reach of the gated ScheduledJob, which could affect network devices, configuration management, or other integrated systems.

Detection Guidance

Sigma Rule

title: Nautobot ApprovalWorkflowStageResponse Forged Creation
id: 7a3b8c1d-4e2f-4a5b-9c6d-8e7f9a0b1c2d
status: experimental
description: Detects creation of ApprovalWorkflowStageResponse with state=approved and user field set to a different user, indicating potential authorization bypass (CVE-2026-83805).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-83805
author: Threat Intelligence
date: 2026-05-12
logsource:
  product: nautobot
  service: application
detection:
  selection:
    event: "ApprovalWorkflowStageResponse created"
    state: "approved"
  filter:
    user_id|equals: "request.user.id"
  condition: selection and not filter
falsepositives:
  - Legitimate approvers submitting their own responses via the intended UI.
level: high

YARA Rule

rule CVE_2026_83805_Nautobot_ApprovalWorkflow_Bypass
{
    meta:
        description = "Detects HTTP POST requests targeting Nautobot ApprovalWorkflowStageResponse endpoint with forged user/state fields"
        author = "Threat Intelligence"
        date = "2026-05-12"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-83805"
        severity = "high"
    strings:
        $s1 = "ApprovalWorkflowStageResponse" ascii wide nocase
        $s2 = "state" ascii wide nocase
        $s3 = "approved" ascii wide nocase
        $s4 = "user" ascii wide nocase
        $s5 = "min_approvers" ascii wide nocase
    condition:
        any of ($s1) and 2 of ($s2, $s3, $s4, $s5)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-83805 Nautobot ApprovalWorkflowStageResponse Forged Creation Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/extras/approval-workflow-stage-responses/"; http_uri; content:"state"; http_client_body; content:"approved"; http_client_body; content:"user"; http_client_body; reference:cve,2026-83805; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-83805; classtype:attempted-admin; sid:202683805; rev:1;)

Elastic Detection

sequence by user.id with maxspan=5m
  [http where http.request.method == "POST" and url.path == "/api/extras/approval-workflow-stage-responses/" and http.request.body contains "state=approved"]
  [http where http.request.method == "POST" and url.path == "/api/extras/approval-workflow-stage-responses/" and http.request.body contains "user="]

Splunk SPL Query

index=web OR index=nautobot sourcetype=access_combined OR sourcetype=nautobot:api
| search (uri_path="/api/extras/approval-workflow-stage-responses/" OR uri="/api/extras/approval-workflow-stage-responses/")
| search (http_method="POST" OR method="POST")
| rex field=request_body "state[=:]\s*\"?(?<state>\w+)"
| rex field=request_body "user[=:]\s*\"?(?<user_id>\d+)"
| where state="approved" AND user_id != authenticated_user_id
| table _time, src_ip, authenticated_user_id, user_id, state, uri_path, http_method
| sort - _time

Wazuh OSSEC Rule

<group name="nautobot,web,">
  <rule id="100838" level="10">
    <decoded_as>json</decoded_as>
    <field name="http_method">POST</field>
    <field name="uri_path">/api/extras/approval-workflow-stage-responses/</field>
    <field name="state">approved</field>
    <field name="user" negate="yes">^$</field>
    <description>CVE-2026-83805: Possible Nautobot ApprovalWorkflowStageResponse forgery attempt detected</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>cve_2026_83805,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Restrict the extras.add_approvalworkflowstageresponse permission to trusted approver groups only; remove it from low-privileged or general users.
   • Monitor and audit all ApprovalWorkflowStageResponse creations, alerting when the user field differs from the authenticated requester or when multiple responses are submitted for the same stage by the same user.
   • Disable or restrict access to the generic create endpoint for ApprovalWorkflowStageResponse via reverse proxy or API gateway rules if feasible.
   • Review existing approval workflow configurations to ensure min_approvers thresholds are not trivially satisfiable by a single user with the create permission.

2. Patch/Upgrade Steps:

   • The NVD description states the issue is fixed in version 3.1.8. Upgrade to Nautobot 3.1.8 or later as soon as possible.
   • Until an official vendor advisory or patch confirmation is available, verify the fix by testing the endpoint behavior after upgrade.
   • If upgrade is not immediately possible, consider applying the above mitigations or temporarily disabling approval workflows that gate critical ScheduledJobs.

3. Long-Term Hardening:

   • Implement defense-in-depth authorization checks in all API endpoints, not just dedicated actions.
   • Enforce object-level permissions and group membership validation at the model or serializer level.
   • Apply the principle of least privilege to all Nautobot permissions, especially those related to workflow and automation.
   • Introduce anomaly detection for approval workflow responses (e.g., response velocity, user-state mismatches).
   • Regularly review and audit ScheduledJobs and their gating workflows.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-83805
• Nautobot GitHub Repository: https://github.com/nautobot/nautobot
• Nautobot Release Notes (3.1.8): https://github.com/nautobot/nautobot/releases/tag/v3.1.8
• CWE-285: Improper Authorization: https://cwe.mitre.org/data/definitions/285.html
• No known threat actor campaigns or exploit-in-the-wild evidence available at this time.