{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/nautobot--2.4.33/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Nautobot (\u003c 2.4.33)","Nautobot (\u003e= 3.0.0a2, \u003c 3.1.2)"],"_cs_severities":["high"],"_cs_tags":["ssrf","nautobot","cve-2026-44797"],"_cs_type":"advisory","_cs_vendors":["Nautobot"],"content_html":"\u003cp\u003eNautobot\u0026rsquo;s \u003ccode\u003eWebhook\u003c/code\u003e data model is susceptible to server-side request forgery (SSRF) due to insufficient restrictions on webhook destinations. This vulnerability allows users with the ability to create or modify \u003ccode\u003eWebhook\u003c/code\u003e records to potentially initiate requests to internal or otherwise restricted hosts and IP addresses. This can lead to information disclosure, internal network scanning, or exploitation of other internal services. The vulnerability affects Nautobot versions prior to 2.4.33 and versions between 3.0.0a2 and 3.1.2. Patches were released on May 13, 2026, in Nautobot v2.4.33 and v3.1.2 to address this issue. New settings \u003ccode\u003eWEBHOOK_ALLOWED_SCHEMES\u003c/code\u003e, \u003ccode\u003eWEBHOOK_ADDITIONAL_BLOCKED_NETWORKS\u003c/code\u003e, and \u003ccode\u003eWEBHOOK_ALLOWED_HOSTS\u003c/code\u003e are introduced to mitigate the risk.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains unauthorized access to a Nautobot account with permissions to manage Webhook objects (add or change).\u003c/li\u003e\n\u003cli\u003eThe attacker creates a new Webhook or modifies an existing one.\u003c/li\u003e\n\u003cli\u003eThe attacker configures the Webhook to send requests to an internal or restricted IP address or hostname. This could be an internal service, a local network address, or a blocked external host.\u003c/li\u003e\n\u003cli\u003eA triggering event occurs within Nautobot that activates the Webhook (e.g., device creation, change of status).\u003c/li\u003e\n\u003cli\u003eNautobot\u0026rsquo;s Webhook functionality initiates an HTTP/HTTPS request to the attacker-specified destination.\u003c/li\u003e\n\u003cli\u003eThe target host receives the request originating from the Nautobot server.\u003c/li\u003e\n\u003cli\u003eThe attacker observes the response from the target host or uses the SSRF to interact with internal services.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages the SSRF to potentially gather sensitive information, bypass access controls, or exploit vulnerable internal services.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this SSRF vulnerability can lead to the exposure of internal network infrastructure, sensitive data residing on internal services, or the ability to pivot to other internal systems. The impact depends on the accessibility and vulnerabilities of the targeted internal services. Without proper restrictions, attackers could potentially compromise the entire Nautobot server and the network it resides on.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to Nautobot version 2.4.33 or 3.1.2 or later to apply the patches for CVE-2026-44797.\u003c/li\u003e\n\u003cli\u003eReview user permissions and restrict \u003ccode\u003eadd\u003c/code\u003e and \u003ccode\u003echange\u003c/code\u003e permissions for the \u003ccode\u003eWebhook\u003c/code\u003e data model to only trusted administrators.\u003c/li\u003e\n\u003cli\u003eAudit existing \u003ccode\u003eWebhook\u003c/code\u003e records for suspicious or unauthorized destination URLs and IP addresses as recommended in the advisory.\u003c/li\u003e\n\u003cli\u003eConfigure the \u003ccode\u003eWEBHOOK_ALLOWED_SCHEMES\u003c/code\u003e setting to restrict Webhooks to only HTTP and HTTPS protocols.\u003c/li\u003e\n\u003cli\u003eUtilize the \u003ccode\u003eWEBHOOK_ADDITIONAL_BLOCKED_NETWORKS\u003c/code\u003e setting to block access to internal networks (e.g., RFC1918 addresses) or other prohibited IP ranges.\u003c/li\u003e\n\u003cli\u003eIf necessary, use the \u003ccode\u003eWEBHOOK_ALLOWED_HOSTS\u003c/code\u003e setting to explicitly allow access to specific hosts that are otherwise blocked by \u003ccode\u003eWEBHOOK_ADDITIONAL_BLOCKED_NETWORKS\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule to detect potentially malicious Webhook configurations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-13T15:32:20Z","date_published":"2026-05-13T15:32:20Z","id":"https://feed.craftedsignal.io/briefs/2026-05-nautobot-ssrf/","summary":"Nautobot's Webhook feature is vulnerable to server-side request forgery (SSRF), allowing users with `add` or `change` permissions to make requests to unauthorized hosts, which is fixed in versions 2.4.33 and 3.1.2 by introducing settings to restrict webhook functionality.","title":"Nautobot Webhook SSRF Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-05-nautobot-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed — Nautobot (\u003c 2.4.33)","version":"https://jsonfeed.org/version/1.1"}