CVE-2026-44797: SSRF in Nautobot ≤3.1.1
Platform
python
Component
nautobot
Fixed in
3.1.2
CVE-2026-44797 describes a Server-Side Request Forgery (SSRF) vulnerability within Nautobot's Webhook functionality. This allows users with sufficient access to craft requests to unintended hosts and IP addresses, potentially leading to unauthorized access and data exposure. The vulnerability affects versions of Nautobot up to and including 3.1.1, and patches are available in versions 2.4.33 and 3.1.2.
Detect this CVE in your project
Upload your requirements.txt file and we'll tell you instantly if you're affected.
Impact and Attack Scenarios
The SSRF vulnerability in Nautobot arises from the ability of users to configure Webhooks that can initiate requests to arbitrary destinations. An attacker could leverage this to scan internal networks, access sensitive resources behind firewalls, or even interact with internal services that should not be publicly accessible. This could lead to data exfiltration, privilege escalation, or denial of service. The impact is amplified if the Nautobot instance is deployed in an environment with sensitive internal resources or if it's used to manage critical infrastructure. The ability to bypass access controls and directly interact with internal systems makes this a significant security risk.
Exploitation Context
CVE-2026-44797 was published on May 13, 2026. Severity is rated HIGH with a CVSS score of 8.5. There is no indication of this vulnerability being actively exploited in the wild, nor is it currently listed on KEV or EPSS. Public proof-of-concept exploits are not currently available, but the SSRF nature of the vulnerability makes it a potential target for automated scanning and exploitation.
Threat Intelligence
Exploit Status
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- Low — any valid user account is sufficient. Basic authenticated access required.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Changed — successful attack can pivot beyond the vulnerable component to other systems or the host OS.
- Confidentiality
- High — complete confidentiality loss. Attacker can read all data: credentials, keys, personal data.
- Integrity
- Low — attacker can modify some data with limited scope or impact.
- Availability
- None — no availability impact. Service remains fully operational.
Affected Software
Timeline
- Published
Mitigation and Workarounds
The primary mitigation for CVE-2026-44797 is to upgrade to Nautobot version 2.4.33 or 3.1.2. These versions include fixes that restrict Webhook requests to HTTP or HTTPS schemes by default. If immediate upgrading is not possible, consider implementing a Web Application Firewall (WAF) or proxy to filter outbound requests from the Nautobot instance, blocking requests to suspicious or unauthorized destinations. Additionally, review existing Webhook configurations to identify and disable any that might be vulnerable. The new settings variables WEBHOOKALLOWEDSCHEMES can be used to further restrict allowed schemes.
How to fix
No official patch available. Check for workarounds or monitor for updates.
Frequently asked questions
What is CVE-2026-44797 — SSRF in Nautobot?
CVE-2026-44797 is a HIGH severity SSRF vulnerability affecting Nautobot versions up to 3.1.1. It allows attackers to make unauthorized requests through misconfigured Webhooks, potentially accessing internal resources.
Am I affected by CVE-2026-44797 in Nautobot?
If you are running Nautobot version 3.1.1 or earlier, you are potentially affected by this vulnerability. Check your version and upgrade as soon as possible.
How do I fix CVE-2026-44797 in Nautobot?
Upgrade to Nautobot version 2.4.33 or 3.1.2. Configure the WEBHOOKALLOWEDSCHEMES setting to restrict allowed schemes and consider using a WAF as an interim measure.
Is CVE-2026-44797 being actively exploited?
There is currently no public evidence of CVE-2026-44797 being actively exploited, but the SSRF nature of the vulnerability warrants vigilance.
Where can I find the official Nautobot advisory for CVE-2026-44797?
Refer to the official Nautobot security advisories on their website or GitHub repository for the most up-to-date information and guidance regarding CVE-2026-44797.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Detect this CVE in your project
Upload your requirements.txt file and we'll tell you instantly if you're affected.
Scan your Python project now — no account
Upload your requirements.txt and get the vulnerability report instantly. No account. Uploading the file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...