CVE-2026-44797: networktocode nautobot

csirt@kutim:~/threat-intel/cve/CVE-2026-44797

CVSS 8.5 · High EPSS 0,40%

Kerentanan Server-Side Request Forgery (SSRF) pada networktocode nautobot. Skor CVSS 3.1 8.5 (High) menurut github.com.

Deskripsi (NVD)

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot's Webhook data model and associated feature set could be configured by users with sufficient access to perform requests to various hosts and IP addresses that should not be permitted, allowing for various behaviors similar to server-side request forgery (SSRF). This vulnerability is fixed in 2.4.33 and 3.1.2.

Rincian

Terbit di NVD: 28 Mei 2026
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-918: Server-Side Request Forgery (SSRF)
EPSS (30 hari): 0,40% peluang dieksploitasi; lebih tinggi dari 32,5% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
networktocode	nautobot	Semua versi sebelum 2.4.33
networktocode	nautobot	Versi 3.0.0 hingga sebelum 3.1.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/nautobot/nautobot/security/advisories/GHSA-c35q-vxrp-ph26 mitigasi · patch · advisory vendor
https://github.com/nautobot/nautobot/commit/16aa4aa9796ab7a31c4d615ec945e1f16d8c77c4 patch
https://github.com/nautobot/nautobot/commit/7324c8f0d8c7245fbc691e15d729adc2d2707d08 patch
https://github.com/nautobot/nautobot/releases/tag/v2.4.33 product · release notes
https://github.com/nautobot/nautobot/releases/tag/v3.1.2 product · release notes

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.