What’s Vulnerable › Vulnerabilities

CVE-2026-44794: Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-28 · updated 2026-10-14
• Weakness: CWE-862

Description

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, in the case of inter-object references via GenericForeignKey (a pattern allowing an object to reference another object that may belong to one of several different "content types" or database tables), when creating or updating an object containing a GenericForeignKey, Nautobot's REST API failed to enforce user "view" permissions when determining whether a given reference to another object would be valid. This vulnerability is fixed in 2.4.33 and 3.1.2.

Affected products

• nautobot: before 2.4.33; from 3.0.0 before 3.1.2 — fixed in 2.4.33, 3.1.2

How to fix

Upgrade to a fixed version: nautobot 2.4.33, 3.1.2. Check the vendor advisory for mitigations.

References

• https://github.com/nautobot/nautobot/commit/36cde7148a207234de6212ec074f321dbc9d1b5b
• https://github.com/nautobot/nautobot/commit/9918bdb9bcf1eb42cda72c344f420a64ef7665f1
• https://github.com/nautobot/nautobot/releases/tag/v2.4.33
• https://github.com/nautobot/nautobot/releases/tag/v3.1.2
• https://github.com/nautobot/nautobot/security/advisories/GHSA-wpxj-44w3-2j6x

Get alerted when CVE-2026-44794 or the next vulnerability affects your stack