CVE-2026-44794: networktocode nautobot

csirt@kutim:~/threat-intel/cve/CVE-2026-44794

CVSS 5.4 · Medium EPSS 0,30%

Kerentanan Missing Authorization pada networktocode nautobot. Skor CVSS 3.1 5.4 (Medium) menurut github.com.

Deskripsi (NVD)

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, in the case of inter-object references via GenericForeignKey (a pattern allowing an object to reference another object that may belong to one of several different "content types" or database tables), when creating or updating an object containing a GenericForeignKey, Nautobot's REST API failed to enforce user "view" permissions when determining whether a given reference to another object would be valid. This vulnerability is fixed in 2.4.33 and 3.1.2.

Rincian

Terbit di NVD: 28 Mei 2026
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 5.4 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-862: Missing Authorization
EPSS (30 hari): 0,30% peluang dieksploitasi; lebih tinggi dari 21,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
networktocode	nautobot	Semua versi sebelum 2.4.33
networktocode	nautobot	Versi 3.0.0 hingga sebelum 3.1.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/nautobot/nautobot/security/advisories/GHSA-wpxj-44w3-2j6x patch · advisory vendor
https://github.com/nautobot/nautobot/commit/36cde7148a207234de6212ec074f321dbc9d1b5b patch
https://github.com/nautobot/nautobot/commit/9918bdb9bcf1eb42cda72c344f420a64ef7665f1 patch
https://github.com/nautobot/nautobot/releases/tag/v2.4.33 product · release notes
https://github.com/nautobot/nautobot/releases/tag/v3.1.2 product · release notes

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.