Nautobot (>= 3.0.0a2, < 3.1.2) — CraftedSignal Threat Feed

Nautobot Webhook SSRF Vulnerability

hello@craftedsignal.io — Wed, 13 May 2026 15:32:20 +0000

Nautobot’s Webhook data model is susceptible to server-side request forgery (SSRF) due to insufficient restrictions on webhook destinations. This vulnerability allows users with the ability to create or modify Webhook records to potentially initiate requests to internal or otherwise restricted hosts and IP addresses. This can lead to information disclosure, internal network scanning, or exploitation of other internal services. The vulnerability affects Nautobot versions prior to 2.4.33 and versions between 3.0.0a2 and 3.1.2. Patches were released on May 13, 2026, in Nautobot v2.4.33 and v3.1.2 to address this issue. New settings WEBHOOK_ALLOWED_SCHEMES, WEBHOOK_ADDITIONAL_BLOCKED_NETWORKS, and WEBHOOK_ALLOWED_HOSTS are introduced to mitigate the risk.

Attack Chain

An attacker gains unauthorized access to a Nautobot account with permissions to manage Webhook objects (add or change).
The attacker creates a new Webhook or modifies an existing one.
The attacker configures the Webhook to send requests to an internal or restricted IP address or hostname. This could be an internal service, a local network address, or a blocked external host.
A triggering event occurs within Nautobot that activates the Webhook (e.g., device creation, change of status).
Nautobot’s Webhook functionality initiates an HTTP/HTTPS request to the attacker-specified destination.
The target host receives the request originating from the Nautobot server.
The attacker observes the response from the target host or uses the SSRF to interact with internal services.
The attacker leverages the SSRF to potentially gather sensitive information, bypass access controls, or exploit vulnerable internal services.

Impact

Successful exploitation of this SSRF vulnerability can lead to the exposure of internal network infrastructure, sensitive data residing on internal services, or the ability to pivot to other internal systems. The impact depends on the accessibility and vulnerabilities of the targeted internal services. Without proper restrictions, attackers could potentially compromise the entire Nautobot server and the network it resides on.

Recommendation

Upgrade to Nautobot version 2.4.33 or 3.1.2 or later to apply the patches for CVE-2026-44797.
Review user permissions and restrict add and change permissions for the Webhook data model to only trusted administrators.
Audit existing Webhook records for suspicious or unauthorized destination URLs and IP addresses as recommended in the advisory.
Configure the WEBHOOK_ALLOWED_SCHEMES setting to restrict Webhooks to only HTTP and HTTPS protocols.
Utilize the WEBHOOK_ADDITIONAL_BLOCKED_NETWORKS setting to block access to internal networks (e.g., RFC1918 addresses) or other prohibited IP ranges.
If necessary, use the WEBHOOK_ALLOWED_HOSTS setting to explicitly allow access to specific hosts that are otherwise blocked by WEBHOOK_ADDITIONAL_BLOCKED_NETWORKS.
Deploy the Sigma rule to detect potentially malicious Webhook configurations.

Nautobot GitRepository current_head Field Writable via REST API (CVE-2026-44798)

hello@craftedsignal.io — Wed, 13 May 2026 15:31:55 +0000

A vulnerability exists in Nautobot versions prior to 2.4.33 and between 3.0.0a2 and 3.1.2 that allows users with the ability to add or change GitRepository records to manipulate the current_head field through the REST API. This field, intended for internal use, dictates the commit hash that Nautobot’s local clone of the repository checks out. By directly modifying this field, an attacker can force the local repository to an arbitrary state, potentially checking out an older commit, a non-existent commit, or a malformed value. This can lead to incorrect or misleading infrastructure state within Nautobot and may require manual intervention to resolve. The vulnerability, identified as CVE-2026-44798, was addressed in Nautobot versions 2.4.33 and 3.1.2.

Attack Chain

An attacker authenticates to the Nautobot REST API with credentials that have permissions to modify GitRepository records.
The attacker identifies a GitRepository record they wish to manipulate.
The attacker crafts a REST API PUT or PATCH request to the GitRepository endpoint.
The request includes a modified current_head field containing a commit hash value. This value may be an older commit hash, a nonexistent commit hash, or a malformed string.
Nautobot processes the API request and updates the current_head field of the specified GitRepository record with the attacker-supplied value.
Nautobot’s background processes attempt to synchronize the local Git repository clone with the updated current_head.
Depending on the value of current_head, the synchronization either checks out the specified commit, fails due to an invalid commit, or corrupts the local repository.
The attacker achieves the objective of desynchronizing Nautobot’s view of the repository state or rendering the repository unusable.

Impact

Successful exploitation of CVE-2026-44798 can cause Nautobot’s view of network infrastructure to become inconsistent with the actual state represented in the Git repository. This can lead to misconfiguration, failed automation tasks, and general operational disruption. In the worst-case scenario, manual intervention is required to correct the current_head value and resynchronize the repository. The number of affected installations is unknown, but any Nautobot instance with users who can modify GitRepository objects is potentially vulnerable.

Recommendation

Upgrade Nautobot to version 2.4.33 or 3.1.2 to address CVE-2026-44798.
Review and restrict user permissions to create and modify GitRepository records, as suggested in the advisory workaround.
Implement the detection rule “Detect Direct Modification of Nautobot GitRepository current_head via API” to monitor for unauthorized changes to the current_head field via the REST API.
Monitor webserver logs for PATCH or PUT requests to the /api/extras/git-repositories// endpoint that contain the current_head parameter, using a rule similar to “Detect API Requests to Modify Nautobot GitRepository current_head”.