CVE-2026-44796Medium· 6.5▾ SunlitNautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot UI object-bulk-rename endpoints (for example, /dcim/interfaces/rename/) were vulnerable to application-wide denial of service via …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
0.3% → 0.6%
Last analysed / modified upstream
Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot UI object-bulk-rename endpoints (for example, /dcim/interfaces/rename/) were vulnerable to application-wide denial of service via maliciously crafted regular expressions in the find field in combination with the use_regex flag. This vulnerability is fixed in 2.4.33 and 3.1.2.
nautobot < 2.4.33nautobot >= 3.0.0, < 3.1.2Upgrade past the affected range:
nautobot 3.1.2Affected packages:
nautobot >= 3.0.0a2, < 3.1.2nautobot < 2.4.33Patched in:
nautobot 3.1.2nautobot 2.4.33Connected by shared product, vendor, weakness, or advisory.
CVE-2026-44794Medium· 5.4Nautobot is a Network Source of Truth and Network Automation Platform
CVE-2026-44798High· 7.1Nautobot is a Network Source of Truth and Network Automation Platform
CVE-2026-44797High· 8.5Nautobot is a Network Source of Truth and Network Automation Platform
CVE-2026-83801Medium· 5.4Nautobot is a Network Source of Truth and Network Automation Platform
CVE-2026-83805Medium· 6.4Nautobot is a Network Source of Truth and Network Automation Platform
CVE-2024-23345High· 7.1XSS potential in rendered Markdown fields (comments, description, notes, etc.)