Nautobot is a Network Source of Truth and Network Automation Platform.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. May 28, 2026 · NIST NVD

   Detected

   Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot's Webhook data model and associated feature set could be configured by users with sufficient access to perform requests to various hosts and IP addresses that should not be permitted, allowing for various behaviors similar to server-side request forgery (SSRF). This vulnerability is fixed in

2. Oct 14, 2026 · NIST NVD

   Updated

   Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot's Webhook data model and associated feature set could be configured by users with sufficient access to perform requests to various hosts and IP addresses that should not be permitted, allowing for various behaviors similar to server-side request forgery (SSRF). This vulnerability is fixed in

Affected

• cpe networktocode/nautobotversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-44797

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-44797

  30-day exploitation probability 0.4%

  first.org
• NIST NVDVulnerability recordCVE-2026-44797

  Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot's Webhook data model and associated feature set could be configured by users with sufficient access to perform requests to various hosts and IP addresses that should not be

  nvd.nist.gov

References

• Patch · github.com
• Patch · github.com
• Product · github.com
• Product · github.com
• Mitigation · github.com