---
id: CVE-2026-44797
title: Nautobot is a Network Source of Truth and Network Automation Platform
summary: >-
  Nautobot is a Network Source of Truth and Network Automation Platform. Prior
  to 2.4.33 and 3.1.2, Nautobot's Webhook data model and associated feature set
  could be configured by users with sufficient access to perform requests to
  various…
severity: high
cvss: 8.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N'
cwe:
  - CWE-918
vendor: networktocode
product: nautobot
affected:
  - nautobot < 2.4.33
  - 'nautobot >= 3.0.0, < 3.1.2'
patched:
  - nautobot 3.1.2
published: '2026-05-28'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T20:10:00.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-44797'
references:
  - url: >-
      https://github.com/nautobot/nautobot/commit/16aa4aa9796ab7a31c4d615ec945e1f16d8c77c4
    label: security-advisories@github.com
  - url: >-
      https://github.com/nautobot/nautobot/commit/7324c8f0d8c7245fbc691e15d729adc2d2707d08
    label: security-advisories@github.com
  - url: 'https://github.com/nautobot/nautobot/releases/tag/v2.4.33'
    label: security-advisories@github.com
  - url: 'https://github.com/nautobot/nautobot/releases/tag/v3.1.2'
    label: security-advisories@github.com
  - url: >-
      https://github.com/nautobot/nautobot/security/advisories/GHSA-c35q-vxrp-ph26
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-44797'
  - url: 'https://github.com/nautobot/nautobot'
tags:
  - nvd
  - osv
  - pip
epss: 0.00235
epssPercentile: 0.14412
aliases:
  - GHSA-c35q-vxrp-ph26
  - PYSEC-2026-2227
ecosystem: pip
ingestedAt: '2026-07-13T18:57:56.194Z'
---

## Overview

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot's Webhook data model and associated feature set could be configured by users with sufficient access to perform requests to various hosts and IP addresses that should not be permitted, allowing for various behaviors similar to server-side request forgery (SSRF). This vulnerability is fixed in 2.4.33 and 3.1.2.

## Affected

- `nautobot < 2.4.33`
- `nautobot >= 3.0.0, < 3.1.2`

## Remediation

Upgrade past the affected range:

- `nautobot 3.1.2`

## Package advisory (CVE-2026-44797)

Affected packages:

- `nautobot >= 3.0.0a2, < 3.1.2`
- `nautobot < 2.4.33`

Patched in:

- `nautobot 3.1.2`
- `nautobot 2.4.33`

Source: https://osv.dev/vulnerability/GHSA-c35q-vxrp-ph26