Log in Start free

Vulnerability · Published May 28, 2026 · Assigned by GitHub_M

CVE-2026-44794Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference

Medium 5.4

In plain English

A medium-severity missing authorization in nautobot from nautobot. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.2%top 92.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, in the case of inter-object references via GenericForeignKey (a pattern allowing an object to reference another object that may belong to one of several different "content types" or database tables), when creating or updating an object containing a GenericForeignKey, Nautobot's REST API failed to enforce user "view" permissions when determining whether a given reference to another object would be valid. This vulnerability is fixed in 2.4.33 and 3.1.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPInautobot3.1.2GHSA-wpxj-44w3-2j6x
PyPInautobot2.4.33GHSA-wpxj-44w3-2j6x
PyPInautobot2.4.33, 3.1.2PYSEC-2026-2225

Affected products (as reported)

VendorProductVersions
nautobot nautobot >= 3.0.0a2, < 3.1.2< 2.4.33

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References