CVE-2026-44797High· 8.5▾ TwilightNautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot's Webhook data model and associated feature set could be configured by users with sufficient access to perform requests to various…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
0.2% → 0.4%
Last analysed / modified upstream
Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot's Webhook data model and associated feature set could be configured by users with sufficient access to perform requests to various hosts and IP addresses that should not be permitted, allowing for various behaviors similar to server-side request forgery (SSRF). This vulnerability is fixed in 2.4.33 and 3.1.2.
nautobot < 2.4.33nautobot >= 3.0.0, < 3.1.2Upgrade past the affected range:
nautobot 3.1.2Affected packages:
nautobot >= 3.0.0a2, < 3.1.2nautobot < 2.4.33Patched in:
nautobot 3.1.2nautobot 2.4.33Connected by shared product, vendor, weakness, or advisory.
CVE-2026-44794Medium· 5.4Nautobot is a Network Source of Truth and Network Automation Platform
CVE-2026-44796Medium· 6.5Nautobot is a Network Source of Truth and Network Automation Platform
CVE-2026-44798High· 7.1Nautobot is a Network Source of Truth and Network Automation Platform
CVE-2026-83801Medium· 5.4Nautobot is a Network Source of Truth and Network Automation Platform
CVE-2026-83805Medium· 6.4Nautobot is a Network Source of Truth and Network Automation Platform
CVE-2024-23345High· 7.1XSS potential in rendered Markdown fields (comments, description, notes, etc.)