CVE-2026-44797CWE-918ssrf

CVE-2026-44797

High · published May 28, 2026

CVSS v3.1
8.5
EPSS
0%
Percentile
33.2
In the wild
Unconfirmed
What it is

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot's Webhook data model and associated feature set could be configured by users with sufficient access to perform requests to various hosts and IP addresses that should not be permitted, allowing for various behaviors similar to server-side request forgery (SSRF). This vulnerability is fixed in 2.4.33 and 3.1.2.

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00401 · 33.2th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-05-28T22:16Z
Affected products (2)
ProductVersionsFixed in
networktocode/nautobot< 2.4.332.4.33
networktocode/nautobot≥ 3.0.0, < 3.1.23.1.2
References (5)
https://github.com/nautobot/nautobot/commit/16aa4aa9796ab7a31c4d615ec945e1f16d8c77c4 · [email protected]https://github.com/nautobot/nautobot/commit/7324c8f0d8c7245fbc691e15d729adc2d2707d08 · [email protected]https://github.com/nautobot/nautobot/releases/tag/v2.4.33 · [email protected]https://github.com/nautobot/nautobot/releases/tag/v3.1.2 · [email protected]https://github.com/nautobot/nautobot/security/advisories/GHSA-c35q-vxrp-ph26 · [email protected]
EPSS history
Timeline
  • 28 MAY 16:59Z
    Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)
    cvelistv5