Nautobot GraphQL permission gap lets queries reach restricted related objects (GHSA-mfwj-pjgx-22v2)

Tier C · Keep an eye on it – Check if you’re affected

Who’s exposed: Nautobot deployments with object permissions enforced on GraphQL queries

Tier C because: Hits tech teams

Reach

Attack

Damage

Fix

The Brief

Nautobot's GraphQL API checked object permissions at the root of a query but not when the query traversed into related models.
In the author's local test on v3.1.4, an account with view permission on Location and no device permission got a 403 from the REST device list but could still reach device data through a GraphQL query.
The issue is tracked as GHSA-mfwj-pjgx-22v2.

Why it matters

Users with limited GraphQL access can read related objects they are not permitted to view, so object-level permissions in Nautobot may not hold for GraphQL queries.

The checklist behind the tier

Checklist · 1 of 10 yes

Yes	Hits tech teams	Judgment: Nautobot is a network automation platform run by network and ops teams.
No	Core infrastructure	Judgment: a single network automation product, not shared core infrastructure like OpenSSH or GitHub.
No	Popular tool	Judgment: Nautobot is a niche network automation platform, not mainstream developer tech.
No	Exploited in the wild	DEV Community describes only a local test on v3.1.4; no observed attacks reported.
No	Public exploit	DEV Community describes a local test result; no published exploit code or PoC is stated.
No	Remote, no login	DEV Community: the attacker needs an account with view permission on Location, so authentication is required.
No	Full takeover	DEV Community: the issue is a permission gap exposing related objects, not code execution or account takeover.
No	Secrets exposed	DEV Community: only a local test showed restricted device data reachable; no stolen or exposed data reported.
No	Supply chain	DEV Community: a normal permission bug in legitimate code; no malicious package or update involved.
No	No fix yet	DEV Community does not state whether a patched version exists; no source says no fix is available.

Source

Allowed to view the Location, handed the Device: a GraphQL permission gap in Nautobot (GHSA-mfwj-pjgx-22v2) ↗ DEV Community: python · 1h ago

First seen 1h ago · 1 source · Full story page · How tiers are decided