PT-2026-40720 · Nautobot+2 · Nautobot

Holmie · Published 2026-05-13 · Updated 2026-05-29 · CVE-2026-44798

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Nautobot versions prior to 2.4.33 Nautobot versions prior to 3.1.2

Description A user with permissions to add or modify a GitRepository record can use the REST API to directly set the current head field, which is not intended to be user-editable. This action may cause local clones of the repository to check out a commit other than the latest one on the specified branch, leading to a misleading state. Additionally, it could render the repository unusable if current head is set to a malformed value or a nonexistent commit hash.

Recommendations Update to version 2.4.33. Update to version 3.1.2. Carefully review and restrict permissions granted to users for creating and modifying GitRepository records.

Fix

Weakness Enumeration

CWE-471

CWE-749

Related Identifiers

CVE-2026-44798

GHSA-P3HX-PWF3-J8WR

Affected Products

Nautobot

References · 12

• https://github.com/nautobot/nautobot/security/advisories/GHSA-p3hx-pwf3-j8wr · Vendor Advisory
• https://github.com/nautobot/nautobot/commit/c46f97040b2bde4320be36b23577f19a8bcbd8c3 · Patch
• https://github.com/nautobot/nautobot/commit/9deddfc91ad9260ad17b5e20084e9e2d15be3609 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-44798 · Security Note
• https://osv.dev/vulnerability/GHSA-p3hx-pwf3-j8wr · Vendor Advisory
• https://github.com/nautobot/nautobot · Note
• https://github.com/nautobot/nautobot/releases/tag/v2.4.33 · Note
• https://github.com/nautobot/nautobot/releases/tag/v3.1.2 · Note
• https://twitter.com/infoflowcloud/status/2060093051620491600 · Twitter Post
• https://twitter.com/CVEnew/status/2060091984434340040 · Twitter Post
• https://twitter.com/dailycve/status/2060186150078218407 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1tcwxup/resumen_diario_de_vulnerabilidades_14052026 · Reddit Post