---
id: CVE-2026-44794
title: Nautobot is a Network Source of Truth and Network Automation Platform
summary: >-
  Nautobot is a Network Source of Truth and Network Automation Platform. Prior
  to 2.4.33 and 3.1.2, in the case of inter-object references via
  GenericForeignKey (a pattern allowing an object to reference another object
  that may belong to o…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-862
vendor: networktocode
product: nautobot
affected:
  - nautobot < 2.4.33
  - 'nautobot >= 3.0.0, < 3.1.2'
patched:
  - nautobot 3.1.2
published: '2026-05-28'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T20:10:00.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-44794'
references:
  - url: >-
      https://github.com/nautobot/nautobot/commit/36cde7148a207234de6212ec074f321dbc9d1b5b
    label: security-advisories@github.com
  - url: >-
      https://github.com/nautobot/nautobot/commit/9918bdb9bcf1eb42cda72c344f420a64ef7665f1
    label: security-advisories@github.com
  - url: 'https://github.com/nautobot/nautobot/releases/tag/v2.4.33'
    label: security-advisories@github.com
  - url: 'https://github.com/nautobot/nautobot/releases/tag/v3.1.2'
    label: security-advisories@github.com
  - url: >-
      https://github.com/nautobot/nautobot/security/advisories/GHSA-wpxj-44w3-2j6x
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-44794'
  - url: 'https://github.com/nautobot/nautobot'
tags:
  - nvd
  - osv
  - pip
epss: 0.00177
epssPercentile: 0.07234
aliases:
  - GHSA-wpxj-44w3-2j6x
  - PYSEC-2026-2225
ecosystem: pip
ingestedAt: '2026-07-13T18:58:04.685Z'
---

## Overview

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, in the case of inter-object references via GenericForeignKey (a pattern allowing an object to reference another object that may belong to one of several different "content types" or database tables), when creating or updating an object containing a GenericForeignKey, Nautobot's REST API failed to enforce user "view" permissions when determining whether a given reference to another object would be valid. This vulnerability is fixed in 2.4.33 and 3.1.2.

## Affected

- `nautobot < 2.4.33`
- `nautobot >= 3.0.0, < 3.1.2`

## Remediation

Upgrade past the affected range:

- `nautobot 3.1.2`

## Package advisory (CVE-2026-44794)

Affected packages:

- `nautobot >= 3.0.0a2, < 3.1.2`
- `nautobot < 2.4.33`

Patched in:

- `nautobot 3.1.2`
- `nautobot 2.4.33`

Source: https://osv.dev/vulnerability/GHSA-wpxj-44w3-2j6x