PT-2026-40719 · Nautobot+2 · Nautobot

Whatisproblem · Published 2026-05-13 · Updated 2026-05-28 · CVE-2026-44797

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nautobot versions prior to 2.4.33 Nautobot versions prior to 3.1.2

Description The Webhook data model and associated feature set can be configured by users with sufficient access to perform requests to unauthorized hosts and IP addresses. This allows for behaviors similar to server-side request forgery (SSRF), where the server is coerced into making unintended requests.

Recommendations Update to version 2.4.33. Update to version 3.1.2. Review users granted add or change permissions for the Webhook data model and audit existing Webhook records for safety and validity. Configure WEBHOOK ALLOWED SCHEMES to restrict records to HTTP or HTTPS. Use WEBHOOK ADDITIONAL BLOCKED NETWORKS to specify IP networks that should be denied for Webhook sending. Use WEBHOOK ALLOWED HOSTS to provide an allow-list of specific hosts that should bypass blocked network configurations.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-44797

GHSA-C35Q-VXRP-PH26

Affected Products

Nautobot

References · 12

• https://github.com/nautobot/nautobot/security/advisories/GHSA-c35q-vxrp-ph26 · Vendor Advisory
• https://github.com/nautobot/nautobot/commit/16aa4aa9796ab7a31c4d615ec945e1f16d8c77c4 · Patch
• https://github.com/nautobot/nautobot/commit/7324c8f0d8c7245fbc691e15d729adc2d2707d08 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-44797 · Security Note
• https://osv.dev/vulnerability/GHSA-c35q-vxrp-ph26 · Vendor Advisory
• https://github.com/nautobot/nautobot/releases/tag/v2.4.33 · Note
• https://github.com/nautobot/nautobot · Note
• https://github.com/nautobot/nautobot/releases/tag/v3.1.2 · Note
• https://twitter.com/CVEnew/status/2060091983209582621 · Twitter Post
• https://twitter.com/infoflowcloud/status/2060093053486960811 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2060133292708430038 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1tcwxup/resumen_diario_de_vulnerabilidades_14052026 · Reddit Post