SB2026051168 - Multiple vulnerabilities in Nautobot

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026051168

SB2026051168 - Multiple vulnerabilities in Nautobot

Published: May 11, 2026

Security Bulletin ID SB2026051168
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 25% Low 75%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Modification of assumed-immutable data (CVE-ID: CVE-2026-44798)

The vulnerability allows a remote user to modify repository state and cause a denial of service.

The vulnerability exists due to modification of assumed-immutable data in the GitRepository.current_head field through the REST API when handling add or change requests for GitRepository records. A remote user can set the current_head field to a nonexistent commit hash or malformed value to modify repository state and cause a denial of service.

The issue can cause local clones of the repository to check out a commit other than the latest commit on the configured branch, resulting in misleading state.


2) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

The vulnerability allows a remote user to perform server-side requests to unintended hosts and IP addresses.

The vulnerability exists due to server-side request forgery in the Webhook data model and associated feature set when processing user-defined webhook destinations. A remote user can configure a webhook to send requests to disallowed destinations to perform server-side requests to unintended hosts and IP addresses.

Exploitation requires add or change permissions for the Webhook data model.


3) Inefficient regular expression complexity (CVE-ID: CVE-2026-44796)

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to inefficient regular expression complexity in object bulk rename UI endpoints when processing a crafted regular expression in the find field with the use_regex flag enabled. A remote user can send a specially crafted request to cause a denial of service.

The issue can result in application-wide impact.


4) Missing Authorization (CVE-ID: CVE-2026-44794)

The vulnerability allows a remote user to reference objects that they should not be able to reference via the REST API.

The vulnerability exists due to missing authorization in GenericForeignKey reference handling in the REST API when creating or updating an object containing a GenericForeignKey. A remote user can submit a crafted API request referencing an object UUID they cannot view to reference objects that they should not be able to reference via the REST API.

Exploitation requires knowledge of the UUID of a target object that is not otherwise accessible to the user.


Remediation

Install update from vendor's website.

References