6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-49142

CVE-2025-49142: Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating

Impact

What kind of vulnerability is it? Who is impacted?

All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected.

Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot:

A malicious user could configure this feature set in ways that could expose the value of Secrets defined in Nautobot when the templated content is rendered.
A malicious user could configure this feature set in ways that could call Python APIs to modify data within Nautobot when the templated content is rendered, bypassing the object permissions assigned to the viewing user.

Patches

Has the problem been patched? What versions should users upgrade to?

Nautobot versions 1.6.32 and 2.4.10 will include fixes for the vulnerability.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

The vulnerability can be partially mitigated by configuring object permissions appropriately to limit the below actions to only trusted users:

extras.add_secret
extras.change_secret
extras.view_secret
extras.add_computedfield
extras.change_computedfield
extras.add_customlink
extras.change_customlink
extras.add_jobbutton
extras.change_jobbutton

References

Are there any links users can visit to find out more?

https://jinja.palletsprojects.com/en/stable/sandbox/
https://docs.djangoproject.com/en/4.2/ref/templates/api/#alters-data-description
https://github.com/nautobot/nautobot/pull/7417
https://github.com/nautobot/nautobot/pull/7429

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-49142

CVE-2025-49142:

6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
nautobot	pip	< 1.6.32	1.6.32
nautobot	pip	>= 2.0.0, < 2.4.10	2.4.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (GHSA-wjw6-95h5-4jpx / CVE-2025-49142) in Nautobot stemmed from an insufficient security configuration of its Jinja2 templating engine. This allowed certain Python methods of objects, available in the template rendering context, to be called directly from user-provided template code (e.g., in computed fields, custom links). These methods were not originally intended to be exposed this way.

This had two primary impacts:

Secrets Exposure: Methods like Secret.get_value() or SecretsGroup.get_secret_value() could be called, leaking sensitive credential information.
Data Manipulation: A wide range of methods that alter object state or database records (e.g., Device.create_components(), UserConfig.set_config(), BaseModel.validated_save()) could be invoked, bypassing normal application workflows, permission checks, and business logic.

The provided patches (e.g., in commits 4091a7d1bb4ed22169815447e4710315c3cf2a91 and 10a02b233bc4bd7a267b7562abae8a9e738122ac) mitigate this by applying security controls to the affected methods. These controls include:

@jinja2.sandbox.unsafe: Marks a function as unsafe, preventing it from being called in a sandboxed Jinja2 environment.
do_not_call_in_templates = True: A Django attribute that prevents the method from being called in Django templates (Nautobot's Jinja2 setup also respects this).
alters_data = True: A Django attribute indicating the method modifies data; such methods are typically restricted from template calls.

The functions listed in vulnerable_functions are those that had these protective attributes/decorators added by the patch. Before the patch, these functions were callable from templates, making them the runtime indicators of this vulnerability being triggered or exploited. An attacker could craft a Jinja2 template that, when rendered by Nautobot, would call one or more of these functions on an accessible object, leading to information disclosure or data modification.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.