CVE-2026-44794

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, in the case of inter-object references via GenericForeignKey (a pattern allowing an object to reference another object that may belong to one of several different "content types" or database tables), when creating or updating an object containing a GenericForeignKey, Nautobot's REST API failed to enforce user "view" permissions when determining whether a given reference to another object would be valid. This vulnerability is fixed in 2.4.33 and 3.1.2.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/nautobot/nautobot/commit/36cde7148a207234de6212ec074f321dbc9d1b5b	Patch
https://github.com/nautobot/nautobot/commit/9918bdb9bcf1eb42cda72c344f420a64ef7665f1	Patch
https://github.com/nautobot/nautobot/releases/tag/v2.4.33	Product Release Notes
https://github.com/nautobot/nautobot/releases/tag/v3.1.2	Product Release Notes
https://github.com/nautobot/nautobot/security/advisories/GHSA-wpxj-44w3-2j6x	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:networktocode:nautobot::::::::
	cpe:2.3:a:networktocode:nautobot::::::::

History

No history.

Information

Published : 2026-05-28 18:16

Updated : 2026-06-17 10:51

NVD link : CVE-2026-44794

Mitre link : CVE-2026-44794

CVE.ORG link : CVE-2026-44794

JSON object : View

Products Affected

networktocode

nautobot

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-44794", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44794", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-30T02:02:38.997080Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nautobot", "product": "nautobot", "versions": [{"status": "affected", "version": ">= 3.0.0a2, < 3.1.2"}, {"status": "affected", "version": "< 2.4.33"}]}]}], "published": "2026-05-28T18:16:33.203", "references": [{"url": "https://github.com/nautobot/nautobot/commit/36cde7148a207234de6212ec074f321dbc9d1b5b", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nautobot/nautobot/commit/9918bdb9bcf1eb42cda72c344f420a64ef7665f1", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nautobot/nautobot/releases/tag/v2.4.33", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nautobot/nautobot/releases/tag/v3.1.2", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-wpxj-44w3-2j6x", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, in the case of inter-object references via GenericForeignKey (a pattern allowing an object to reference another object that may belong to one of several different \"content types\" or database tables), when creating or updating an object containing a GenericForeignKey, Nautobot's REST API failed to enforce user \"view\" permissions when determining whether a given reference to another object would be valid. This vulnerability is fixed in 2.4.33 and 3.1.2."}], "lastModified": "2026-06-17T10:51:20.220", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:networktocode:nautobot:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1519124C-E6CD-44DF-8DD7-D4A7003ADF94", "versionEndExcluding": "2.4.33"}, {"criteria": "cpe:2.3:a:networktocode:nautobot:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8419C360-D723-4365-82B1-B4DE637BE43C", "versionEndExcluding": "3.1.2", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}