Vulnerability · Published May 28, 2026 · Assigned by GitHub_M

CVE-2026-44797Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)

High 8.5

In plain English

A high-severity server-side request forgery in nautobot from nautobot. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.5High

Exploit odds (30 days)0.2%top 85.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot's Webhook data model and associated feature set could be configured by users with sufficient access to perform requests to various hosts and IP addresses that should not be permitted, allowing for various behaviors similar to server-side request forgery (SSRF). This vulnerability is fixed in 2.4.33 and 3.1.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	nautobot	3.1.2	GHSA-c35q-vxrp-ph26
PyPI	nautobot	2.4.33	GHSA-c35q-vxrp-ph26
PyPI	nautobot	2.4.33, 3.1.2	PYSEC-2026-2227

Affected products (as reported)

Vendor	Product	Versions
nautobot	nautobot	>= 3.0.0a2, < 3.1.2< 2.4.33

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

References

https://github.com/nautobot/nautobot/security/advisories/GHSA-c35q-vxrp-ph26 x_refsource_CONFIRM
https://github.com/nautobot/nautobot/commit/16aa4aa9796ab7a31c4d615ec945e1f16d8c77c4 x_refsource_MISC
https://github.com/nautobot/nautobot/commit/7324c8f0d8c7245fbc691e15d729adc2d2707d08 x_refsource_MISC
https://github.com/nautobot/nautobot/releases/tag/v2.4.33 x_refsource_MISC
https://github.com/nautobot/nautobot/releases/tag/v3.1.2 x_refsource_MISC