CVE-2026-44794
2 advisories.
PyPI/nautobot CVE-2026-44794: medium 5.4, EPSS 0.30%
Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference
Action: Upgrade nautobot to 2.4.33 or later.
pip install nautobot==3.1.2pip install nautobot==2.4.33Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0a2 | 3.1.2 | - |
| 0 | 2.4.33 | - |
Fixed versions
| 3.1.2 | 2.4.33 |
Sources
- osv: GHSA-wpxj-44w3-2j6x
- https://github.com/nautobot/nautobot/security/advisories/GHSA-wpxj-44w3-2j6x
- https://nvd.nist.gov/vuln/detail/CVE-2026-44794
- https://github.com/nautobot/nautobot/commit/36cde7148a207234de6212ec074f321dbc9d1b5b
- https://github.com/nautobot/nautobot/commit/9918bdb9bcf1eb42cda72c344f420a64ef7665f1
- https://github.com/nautobot/nautobot
- https://github.com/nautobot/nautobot/releases/tag/v2.4.33
- https://github.com/nautobot/nautobot/releases/tag/v3.1.2
CVE-2026-44794 · published · modified · JSON
PyPI/nautobot CVE-2026-44794: medium 5.4, EPSS 0.30%
Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, in the case of inter-object references via GenericForeignKey (a pattern allowing an object to referenc
Action: Upgrade nautobot to 2.4.33 or later.
pip install nautobot==2.4.33pip install nautobot==3.1.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.4.33 | - |
| 3.0.0 | 3.1.2 | - |
Fixed versions
| 2.4.33 | 3.1.2 |
Sources
- osv: PYSEC-2026-2225
- https://github.com/nautobot/nautobot/releases/tag/v2.4.33
- https://github.com/nautobot/nautobot/releases/tag/v3.1.2
- https://github.com/nautobot/nautobot/commit/36cde7148a207234de6212ec074f321dbc9d1b5b
- https://github.com/nautobot/nautobot/commit/9918bdb9bcf1eb42cda72c344f420a64ef7665f1
- https://github.com/nautobot/nautobot/security/advisories/GHSA-wpxj-44w3-2j6x
CVE-2026-44794 · published · modified · JSON