8.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44797

CVE-2026-44797: Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot's Webhook data model and associated feature set could be configured by users with sufficient access to perform requests to various hosts and IP addresses that should not be permitted, allowing for various behaviors similar to server-side request forgery (SSRF). This vulnerability is fixed in 2.4.33 and 3.1.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44797

CVE-2026-44797:

8.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
nautobot	pip	>= 3.0.0a2, < 3.1.2	3.1.2
nautobot	pip	< 2.4.33	2.4.33

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the lack of validation of the payload_url for webhooks, leading to a Server-Side Request Forgery (SSRF) vulnerability. The analysis of the patches reveals two key locations where this vulnerability was addressed.

At Creation/Update Time: The Webhook.clean method in nautobot/extras/models/models.py is responsible for validating webhook data before it's saved. The patch adds a call to a new validation function, validate_webhook_url_format, within this method. Before this change, a user with permissions to manage webhooks could configure a payload_url pointing to a restricted internal network resource.
At Execution Time: The process_webhook function in nautobot/extras/tasks.py is the background task that sends the webhook. The patch adds a call to validate_webhook_url at the beginning of this function. This serves as a defense-in-depth measure, re-validating the URL and its resolved IP address right before the outbound request is made. This is crucial because the network environment of the Celery worker (which runs this task) might be different from the web server, and it also protects against DNS rebinding attacks and addresses webhooks created before the patch was applied.

The root cause was the trust placed in the user-provided payload_url without sufficient checks. An attacker with privileges to create or edit a webhook could make Nautobot send requests to any IP address and port accessible from the server, allowing them to scan internal networks, access sensitive internal services, or exfiltrate data.

Vulnerable functions

Webhook.clean

nautobot/extras/models/models.py

The `clean` method on the `Webhook` model is called when creating or updating a webhook. Before the patch, this method lacked validation for the `payload_url` field, allowing a user to save a webhook with a URL pointing to a restricted internal service. The patch adds a call to `validate_webhook_url_format` to prevent this.

process_webhook

nautobot/extras/tasks.py

This function is a Celery task that executes the webhook request. Prior to the patch, it would make an HTTP request to the `payload_url` without validating the destination IP address. This could be exploited for SSRF by triggering a pre-configured malicious webhook. The patch introduces a call to `validate_webhook_url` to perform validation, including DNS resolution checks, just before the request is sent.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.