id: PYSEC-2026-2227
published: "2026-05-28T18:16:33.837Z"
modified: "2026-07-13T05:50:10.723610Z"
aliases:
- CVE-2026-44797
- GHSA-c35q-vxrp-ph26
details: Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot's Webhook data model and associated feature set could be configured by users with sufficient access to perform requests to various hosts and IP addresses that should not be permitted, allowing for various behaviors similar to server-side request forgery (SSRF). This vulnerability is fixed in 2.4.33 and 3.1.2.
affected:
- package:
    name: nautobot
    ecosystem: PyPI
    purl: pkg:pypi/nautobot
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.4.33
    - introduced: 3.0.0
    - fixed: 3.1.2
  versions:
  - 1.0.0
  - 1.0.0a1
  - 1.0.0a2
  - 1.0.0b1
  - 1.0.0b2
  - 1.0.0b3
  - 1.0.0b4
  - 1.0.1
  - 1.0.2
  - 1.0.3
  - 1.1.0
  - 1.1.1
  - 1.1.2
  - 1.1.3
  - 1.1.4
  - 1.1.5
  - 1.1.6
  - 1.2.0
  - 1.2.1
  - 1.2.10
  - 1.2.11
  - 1.2.2
  - 1.2.3
  - 1.2.4
  - 1.2.5
  - 1.2.6
  - 1.2.7
  - 1.2.8
  - 1.2.9
  - 1.3.0
  - 1.3.1
  - 1.3.10
  - 1.3.2
  - 1.3.3
  - 1.3.4
  - 1.3.5
  - 1.3.6
  - 1.3.7
  - 1.3.8
  - 1.3.9
  - 1.4.0
  - 1.4.1
  - 1.4.10
  - 1.4.2
  - 1.4.3
  - 1.4.4
  - 1.4.5
  - 1.4.7
  - 1.4.8
  - 1.4.9
  - 1.5.0
  - 1.5.1
  - 1.5.10
  - 1.5.11
  - 1.5.12
  - 1.5.13
  - 1.5.14
  - 1.5.15
  - 1.5.16
  - 1.5.17
  - 1.5.18
  - 1.5.19
  - 1.5.2
  - 1.5.20
  - 1.5.21
  - 1.5.22
  - 1.5.23
  - 1.5.24
  - 1.5.3
  - 1.5.4
  - 1.5.5
  - 1.5.6
  - 1.5.7
  - 1.5.8
  - 1.5.9
  - 1.6.0
  - 1.6.1
  - 1.6.10
  - 1.6.11
  - 1.6.12
  - 1.6.13
  - 1.6.14
  - 1.6.15
  - 1.6.16
  - 1.6.17
  - 1.6.18
  - 1.6.19
  - 1.6.2
  - 1.6.20
  - 1.6.21
  - 1.6.22
  - 1.6.23
  - 1.6.24
  - 1.6.25
  - 1.6.26
  - 1.6.27
  - 1.6.28
  - 1.6.29
  - 1.6.3
  - 1.6.30
  - 1.6.31
  - 1.6.32
  - 1.6.4
  - 1.6.5
  - 1.6.6
  - 1.6.7
  - 1.6.8
  - 1.6.9
  - 2.0.0
  - 2.0.1
  - 2.0.2
  - 2.0.3
  - 2.0.4
  - 2.0.5
  - 2.0.6
  - 2.1.0
  - 2.1.0b1
  - 2.1.1
  - 2.1.2
  - 2.1.3
  - 2.1.4
  - 2.1.5
  - 2.1.6
  - 2.1.7
  - 2.1.8
  - 2.1.9
  - 2.2.0
  - 2.2.0b1
  - 2.2.1
  - 2.2.2
  - 2.2.3
  - 2.2.4
  - 2.2.5
  - 2.2.6
  - 2.2.7
  - 2.2.8
  - 2.2.9
  - 2.3.0
  - 2.3.0b1
  - 2.3.1
  - 2.3.10
  - 2.3.11
  - 2.3.12
  - 2.3.13
  - 2.3.14
  - 2.3.15
  - 2.3.15b1
  - 2.3.16
  - 2.3.2
  - 2.3.3
  - 2.3.4
  - 2.3.5
  - 2.3.6
  - 2.3.7
  - 2.3.8
  - 2.3.9
  - 2.4.0
  - 2.4.0b1
  - 2.4.1
  - 2.4.10
  - 2.4.11
  - 2.4.12
  - 2.4.13
  - 2.4.14
  - 2.4.15
  - 2.4.16
  - 2.4.17
  - 2.4.18
  - 2.4.19
  - 2.4.2
  - 2.4.20
  - 2.4.21
  - 2.4.22
  - 2.4.23
  - 2.4.24
  - 2.4.25
  - 2.4.26
  - 2.4.27
  - 2.4.28
  - 2.4.29
  - 2.4.3
  - 2.4.30
  - 2.4.31
  - 2.4.32
  - 2.4.4
  - 2.4.5
  - 2.4.6
  - 2.4.7
  - 2.4.8
  - 2.4.9
  - 3.0.0
  - 3.0.1
  - 3.0.10
  - 3.0.11
  - 3.0.2
  - 3.0.3
  - 3.0.4
  - 3.0.5
  - 3.0.6
  - 3.0.7
  - 3.0.8
  - 3.0.9
  - 3.1.0
  - 3.1.0a1
  - 3.1.0a2
  - 3.1.0a3
  - 3.1.0a4
  - 3.1.0a5
  - 3.1.1
  ecosystem_specific: {}
references:
- type: ADVISORY
  url: https://github.com/nautobot/nautobot/releases/tag/v2.4.33
- type: ADVISORY
  url: https://github.com/nautobot/nautobot/releases/tag/v3.1.2
- type: FIX
  url: https://github.com/nautobot/nautobot/commit/16aa4aa9796ab7a31c4d615ec945e1f16d8c77c4
- type: FIX
  url: https://github.com/nautobot/nautobot/commit/7324c8f0d8c7245fbc691e15d729adc2d2707d08
- type: FIX
  url: https://github.com/nautobot/nautobot/security/advisories/GHSA-c35q-vxrp-ph26
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N