---
id: CVE-2025-62607
aliases:
  - GHSA-535g-62r7-cx6v
  - PYSEC-2026-1690
title: >-
  Nautobot Single Source of Truth (SSoT) has an unauthenticated ServiceNow
  configuration URL
summary: >-
  Nautobot Single Source of Truth (SSoT) has an unauthenticated ServiceNow
  configuration URL
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
vendor: nautobot-ssot
product: nautobot-ssot
ecosystem: pip
affected:
  - nautobot-ssot < 3.10.0
patched:
  - nautobot-ssot 3.10.0
published: '2025-10-21'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-535g-62r7-cx6v'
references:
  - url: >-
      https://github.com/nautobot/nautobot-app-ssot/security/advisories/GHSA-535g-62r7-cx6v
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-62607'
  - url: >-
      https://github.com/nautobot/nautobot-app-ssot/commit/1530d25cdeb929641ec47644f9a0a1d9d41e1cb8
  - url: 'https://github.com/nautobot/nautobot-app-ssot'
  - url: 'https://github.com/nautobot/nautobot-app-ssot/releases/tag/v3.10.0'
tags:
  - osv
  - pip
epss: 0.00294
epssPercentile: 0.19687
ingestedAt: '2026-07-08T18:25:45.745Z'
---

## Overview

The servicenow config URL is using a generic django View with no authentication.

URL: `/plugins/ssot/servicenow/config/`

### Impact
_What kind of vulnerability is it? Who is impacted?_
An Unauthenticated attacker could access this page to view the Service Now public instance name e.g. `companyname.service-now.com`. This is considered **low-value information**.  This does not expose the Secret, the Secret Name, or the Secret Value for the Username/Password for Service-Now.com. An unauthenticated member would not be able to change the instance name, nor set a Secret. There is not a way to gain access to other pages Nautobot through the unauthenticated Configuration page.

### Patches
_Has the problem been patched? What versions should users upgrade to?_
We highly recommend upgrading to SSoT v3.10.0 which includes this patch.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
Disable the servicenow SSoT integration

## Affected packages

- `nautobot-ssot < 3.10.0`

## Remediation

Upgrade to a patched release:

- `nautobot-ssot 3.10.0`