{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/gitrepository/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Nautobot ( \u003c 2.4.33)","Nautobot (\u003e= 3.0.0a2, \u003c 3.1.2)"],"_cs_severities":["high"],"_cs_tags":["nautobot","gitrepository","rest-api","privilege-escalation"],"_cs_type":"advisory","_cs_vendors":["Nautobot"],"content_html":"\u003cp\u003eA vulnerability exists in Nautobot versions prior to 2.4.33 and between 3.0.0a2 and 3.1.2 that allows users with the ability to add or change GitRepository records to manipulate the \u003ccode\u003ecurrent_head\u003c/code\u003e field through the REST API. This field, intended for internal use, dictates the commit hash that Nautobot\u0026rsquo;s local clone of the repository checks out. By directly modifying this field, an attacker can force the local repository to an arbitrary state, potentially checking out an older commit, a non-existent commit, or a malformed value. This can lead to incorrect or misleading infrastructure state within Nautobot and may require manual intervention to resolve. The vulnerability, identified as CVE-2026-44798, was addressed in Nautobot versions 2.4.33 and 3.1.2.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker authenticates to the Nautobot REST API with credentials that have permissions to modify GitRepository records.\u003c/li\u003e\n\u003cli\u003eThe attacker identifies a GitRepository record they wish to manipulate.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a REST API PUT or PATCH request to the GitRepository endpoint.\u003c/li\u003e\n\u003cli\u003eThe request includes a modified \u003ccode\u003ecurrent_head\u003c/code\u003e field containing a commit hash value. This value may be an older commit hash, a nonexistent commit hash, or a malformed string.\u003c/li\u003e\n\u003cli\u003eNautobot processes the API request and updates the \u003ccode\u003ecurrent_head\u003c/code\u003e field of the specified GitRepository record with the attacker-supplied value.\u003c/li\u003e\n\u003cli\u003eNautobot\u0026rsquo;s background processes attempt to synchronize the local Git repository clone with the updated \u003ccode\u003ecurrent_head\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDepending on the value of \u003ccode\u003ecurrent_head\u003c/code\u003e, the synchronization either checks out the specified commit, fails due to an invalid commit, or corrupts the local repository.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves the objective of desynchronizing Nautobot\u0026rsquo;s view of the repository state or rendering the repository unusable.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-44798 can cause Nautobot\u0026rsquo;s view of network infrastructure to become inconsistent with the actual state represented in the Git repository. This can lead to misconfiguration, failed automation tasks, and general operational disruption. In the worst-case scenario, manual intervention is required to correct the \u003ccode\u003ecurrent_head\u003c/code\u003e value and resynchronize the repository. The number of affected installations is unknown, but any Nautobot instance with users who can modify GitRepository objects is potentially vulnerable.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Nautobot to version 2.4.33 or 3.1.2 to address CVE-2026-44798.\u003c/li\u003e\n\u003cli\u003eReview and restrict user permissions to create and modify GitRepository records, as suggested in the advisory workaround.\u003c/li\u003e\n\u003cli\u003eImplement the detection rule \u0026ldquo;Detect Direct Modification of Nautobot GitRepository current_head via API\u0026rdquo; to monitor for unauthorized changes to the \u003ccode\u003ecurrent_head\u003c/code\u003e field via the REST API.\u003c/li\u003e\n\u003cli\u003eMonitor webserver logs for PATCH or PUT requests to the \u003ccode\u003e/api/extras/git-repositories/\u0026lt;id\u0026gt;/\u003c/code\u003e endpoint that contain the \u003ccode\u003ecurrent_head\u003c/code\u003e parameter, using a rule similar to \u0026ldquo;Detect API Requests to Modify Nautobot GitRepository current_head\u0026rdquo;.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-13T15:31:55Z","date_published":"2026-05-13T15:31:55Z","id":"https://feed.craftedsignal.io/briefs/2026-05-nautobot-gitrepository-writable/","summary":"A user with permissions to modify GitRepository records can manipulate the `current_head` field via the REST API in Nautobot, leading to repository state desynchronization or unavailability; this is remediated in versions 2.4.33 and 3.1.2.","title":"Nautobot GitRepository current_head Field Writable via REST API (CVE-2026-44798)","url":"https://feed.craftedsignal.io/briefs/2026-05-nautobot-gitrepository-writable/"}],"language":"en","title":"CraftedSignal Threat Feed — Gitrepository","version":"https://jsonfeed.org/version/1.1"}