Vulnerability Description
Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot's Webhook data model and associated feature set could be configured by users with sufficient access to perform requests to various hosts and IP addresses that should not be permitted, allowing for various behaviors similar to server-side request forgery (SSRF). This vulnerability is fixed in 2.4.33 and 3.1.2.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Networktocode | Nautobot | < 2.4.33 |
Related Weaknesses (CWE)
References
- https://github.com/nautobot/nautobot/commit/16aa4aa9796ab7a31c4d615ec945e1f16d8cPatch
- https://github.com/nautobot/nautobot/commit/7324c8f0d8c7245fbc691e15d729adc2d270Patch
- https://github.com/nautobot/nautobot/releases/tag/v2.4.33ProductRelease Notes
- https://github.com/nautobot/nautobot/releases/tag/v3.1.2ProductRelease Notes
- https://github.com/nautobot/nautobot/security/advisories/GHSA-c35q-vxrp-ph26MitigationPatchVendor Advisory
FAQ
What is CVE-2026-44797?
CVE-2026-44797 is a vulnerability with a CVSS score of 8.5 (HIGH). Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot's Webhook data model and associated feature set could be configured by users with sufficient ...
How severe is CVE-2026-44797?
CVE-2026-44797 has been rated HIGH with a CVSS base score of 8.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-44797?
Check the references section above for vendor advisories and patch information. Affected products include: Networktocode Nautobot.