CVE-2026-44797 Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)

What is CVE-2026-44797?

CVE-2026-44797 is a high-severity server-side request forgery vulnerability in nautobot, published on 28 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot's Webhook data model and associated feature set could be configured by users with sufficient access to perform requests to various hosts and IP addresses that should not be permitted, allowing for various behaviors similar to server-side request forgery (SSRF). This vulnerability is fixed in 2.4.33 and 3.1.2.

Weakness: CWE-918

Which versions are affected by CVE-2026-44797?

5 open source packages ship an affected version, including nautobot. It affects 1 product.

Products include Networktocode Nautobot.

How do I fix CVE-2026-44797?

Upgrade nautobot to a fixed version for your release line: 2.4.33 or 3.1.2.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-44797 being exploited?

There is no known exploitation of CVE-2026-44797 in the wild and no public exploit code.

Other vulnerabilities in nautobot

• CVE-2024-34707 Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages High 7.5
• CVE-2024-32979 Reflected Cross-site Scripting potential in all object list views in Nautobot High 7.5
• CVE-2023-25657 Remote code execution in Jinja2 template rendering in Nautobot High 7.5
• CVE-2026-44798 Nautobot: GitRepository.current_head field should not be writable through REST API High 7.1
• CVE-2024-23345 Nautobot has XSS potential in rendered Markdown fields High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-c35q-vxrp-ph26, PYSEC-2026-2227.