7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44798

CVE-2026-44798: Nautobot: GitRepository.current_head field should not be writable through REST API

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, a user with access to add/change a GitRepository record could use the REST API to directly set the current_head field on the record, which was not intended to be user-editable. Doing so could cause Nautobot's local clone(s) of the relevant repository to checkout a commit other than the latest commit on the specified branch (resulting in misleading state), or potentially to be unable to make use of the repository at all (until manually remediated) due to the current_head pointing to a nonexistent commit hash or malformed value. This vulnerability is fixed in 2.4.33 and 3.1.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44798

CVE-2026-44798:

7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
nautobot	pip	>= 3.0.0a2, < 3.1.2	3.1.2
nautobot	pip	< 2.4.33	2.4.33

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because the current_head field of the GitRepository model was writable through the REST API. This was due to the GitRepositorySerializer not marking the field as read-only. An attacker with permissions to add or change a GitRepository could send a crafted request to set current_head to a malicious value. This could lead to a denial of service if the value is a non-existent commit, or it could cause the repository to check out an older or different commit than intended, leading to a misleading state. The lack of validation in the GitRepository.clean method and the GitRepo.checkout method exacerbated this issue, as it allowed malformed or malicious values to be processed. The patch addresses these issues by making current_head read-only in the serializer and adding validation in the model and git utility functions.

Vulnerable functions

GitRepositorySerializer

nautobot/extras/api/serializers.py

The `GitRepositorySerializer` is responsible for serializing and deserializing `GitRepository` objects for the REST API. Before the patch, the `current_head` field was not included in the `read_only_fields` list. This meant that a user could provide a value for `current_head` in a POST or PATCH request, and the serializer would attempt to update the model with this value. This is the primary entry point for the vulnerability.

GitRepository.clean

nautobot/extras/models/datasources.py

The `clean` method on the `GitRepository` model is called to perform model-wide validation. Before the patch, this method did not perform any validation on the `current_head` field. This meant that if a user could write to this field (which they could, via the serializer), they could write a malformed value that could cause issues later when the value is used. The patch adds a call to `validate_commit_hexsha` to ensure that the value is a valid commit hash.

GitRepo.checkout

nautobot/core/utils/git.py

The `checkout` method of the `GitRepo` class is used to check out a specific branch or commit. Before the patch, this method did not validate the `commit_hexsha` parameter. If a user could control the value of `current_head` on a `GitRepository` object, this value could be passed to the `checkout` method as the `commit_hexsha` parameter. A malicious value could potentially lead to command injection, as the value is used in a shell command. The patch adds a call to `validate_git_ref` to ensure that the value is a valid git reference.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.