ETK-2026-4134Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-4134",
  "cve_id": null,
  "display_id": "ETK-2026-4134",
  "ghsa_id": "GHSA-546w-cg72-vf5w",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Sensitive-field disclosure through Jinja2 queryset filters in Nautobot",
  "summary": "Nautobot versions before 2.4.46 on the 2.4 line and 3.2.9 on the 3.2 line may expose sensitive user fields through user-authored Jinja2 templates. An attacker who can create or modify an applicable template may infer API token keys or password hashes for users reachable in the template context, potentially enabling account compromise.",
  "mitigation": "Upgrade Nautobot to 2.4.46 or later, or 3.2.9 or later. Restrict template-authoring permissions to trusted administrators, audit existing templates for filtering of user or token data, and rotate potentially exposed credentials.",
  "vendor": "pip",
  "product": "pip:nautobot",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<2.4.46"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "2.4.46"
      ],
      "package_name": "nautobot",
      "purl": "pkg:pypi/nautobot"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">=3.0.0",
        "<3.2.9"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "3.2.9"
      ],
      "package_name": "nautobot",
      "purl": "pkg:pypi/nautobot"
    }
  ],
  "cwes": [
    200
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 67.13432678333334,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-11-09T16:27:32+00:00",
      "days": -1.594559405289352,
      "is_lower_bound": true,
      "measured_at": "2026-11-11T06:43:41.972263+00:00",
      "url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-546w-cg72-vf5w"
    }
  }
}