Vulnerability-Lookup

PYSEC-2026-2225

Vulnerability from pysec - Published: 2026-05-28 18:16 - Updated: 2026-07-13 05:50

Details

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, in the case of inter-object references via GenericForeignKey (a pattern allowing an object to reference another object that may belong to one of several different "content types" or database tables), when creating or updating an object containing a GenericForeignKey, Nautobot's REST API failed to enforce user "view" permissions when determining whether a given reference to another object would be valid. This vulnerability is fixed in 2.4.33 and 3.1.2.

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Impacted products

Name	purl
nautobot	pkg:pypi/nautobot

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "PyPI",
        "name": "nautobot",
        "purl": "pkg:pypi/nautobot"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.33"
            },
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.0",
        "1.0.0a1",
        "1.0.0a2",
        "1.0.0b1",
        "1.0.0b2",
        "1.0.0b3",
        "1.0.0b4",
        "1.0.1",
        "1.0.2",
        "1.0.3",
        "1.1.0",
        "1.1.1",
        "1.1.2",
        "1.1.3",
        "1.1.4",
        "1.1.5",
        "1.1.6",
        "1.2.0",
        "1.2.1",
        "1.2.10",
        "1.2.11",
        "1.2.2",
        "1.2.3",
        "1.2.4",
        "1.2.5",
        "1.2.6",
        "1.2.7",
        "1.2.8",
        "1.2.9",
        "1.3.0",
        "1.3.1",
        "1.3.10",
        "1.3.2",
        "1.3.3",
        "1.3.4",
        "1.3.5",
        "1.3.6",
        "1.3.7",
        "1.3.8",
        "1.3.9",
        "1.4.0",
        "1.4.1",
        "1.4.10",
        "1.4.2",
        "1.4.3",
        "1.4.4",
        "1.4.5",
        "1.4.7",
        "1.4.8",
        "1.4.9",
        "1.5.0",
        "1.5.1",
        "1.5.10",
        "1.5.11",
        "1.5.12",
        "1.5.13",
        "1.5.14",
        "1.5.15",
        "1.5.16",
        "1.5.17",
        "1.5.18",
        "1.5.19",
        "1.5.2",
        "1.5.20",
        "1.5.21",
        "1.5.22",
        "1.5.23",
        "1.5.24",
        "1.5.3",
        "1.5.4",
        "1.5.5",
        "1.5.6",
        "1.5.7",
        "1.5.8",
        "1.5.9",
        "1.6.0",
        "1.6.1",
        "1.6.10",
        "1.6.11",
        "1.6.12",
        "1.6.13",
        "1.6.14",
        "1.6.15",
        "1.6.16",
        "1.6.17",
        "1.6.18",
        "1.6.19",
        "1.6.2",
        "1.6.20",
        "1.6.21",
        "1.6.22",
        "1.6.23",
        "1.6.24",
        "1.6.25",
        "1.6.26",
        "1.6.27",
        "1.6.28",
        "1.6.29",
        "1.6.3",
        "1.6.30",
        "1.6.31",
        "1.6.32",
        "1.6.4",
        "1.6.5",
        "1.6.6",
        "1.6.7",
        "1.6.8",
        "1.6.9",
        "2.0.0",
        "2.0.1",
        "2.0.2",
        "2.0.3",
        "2.0.4",
        "2.0.5",
        "2.0.6",
        "2.1.0",
        "2.1.0b1",
        "2.1.1",
        "2.1.2",
        "2.1.3",
        "2.1.4",
        "2.1.5",
        "2.1.6",
        "2.1.7",
        "2.1.8",
        "2.1.9",
        "2.2.0",
        "2.2.0b1",
        "2.2.1",
        "2.2.2",
        "2.2.3",
        "2.2.4",
        "2.2.5",
        "2.2.6",
        "2.2.7",
        "2.2.8",
        "2.2.9",
        "2.3.0",
        "2.3.0b1",
        "2.3.1",
        "2.3.10",
        "2.3.11",
        "2.3.12",
        "2.3.13",
        "2.3.14",
        "2.3.15",
        "2.3.15b1",
        "2.3.16",
        "2.3.2",
        "2.3.3",
        "2.3.4",
        "2.3.5",
        "2.3.6",
        "2.3.7",
        "2.3.8",
        "2.3.9",
        "2.4.0",
        "2.4.0b1",
        "2.4.1",
        "2.4.10",
        "2.4.11",
        "2.4.12",
        "2.4.13",
        "2.4.14",
        "2.4.15",
        "2.4.16",
        "2.4.17",
        "2.4.18",
        "2.4.19",
        "2.4.2",
        "2.4.20",
        "2.4.21",
        "2.4.22",
        "2.4.23",
        "2.4.24",
        "2.4.25",
        "2.4.26",
        "2.4.27",
        "2.4.28",
        "2.4.29",
        "2.4.3",
        "2.4.30",
        "2.4.31",
        "2.4.32",
        "2.4.4",
        "2.4.5",
        "2.4.6",
        "2.4.7",
        "2.4.8",
        "2.4.9",
        "3.0.0",
        "3.0.1",
        "3.0.10",
        "3.0.11",
        "3.0.2",
        "3.0.3",
        "3.0.4",
        "3.0.5",
        "3.0.6",
        "3.0.7",
        "3.0.8",
        "3.0.9",
        "3.1.0",
        "3.1.0a1",
        "3.1.0a2",
        "3.1.0a3",
        "3.1.0a4",
        "3.1.0a5",
        "3.1.1"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44794",
    "GHSA-wpxj-44w3-2j6x"
  ],
  "details": "Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, in the case of inter-object references via GenericForeignKey (a pattern allowing an object to reference another object that may belong to one of several different \"content types\" or database tables), when creating or updating an object containing a GenericForeignKey, Nautobot\u0027s REST API failed to enforce user \"view\" permissions when determining whether a given reference to another object would be valid. This vulnerability is fixed in 2.4.33 and 3.1.2.",
  "id": "PYSEC-2026-2225",
  "modified": "2026-07-13T05:50:10.369922Z",
  "published": "2026-05-28T18:16:33.203Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/nautobot/nautobot/releases/tag/v2.4.33"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/nautobot/nautobot/releases/tag/v3.1.2"
    },
    {
      "type": "FIX",
      "url": "https://github.com/nautobot/nautobot/commit/36cde7148a207234de6212ec074f321dbc9d1b5b"
    },
    {
      "type": "FIX",
      "url": "https://github.com/nautobot/nautobot/commit/9918bdb9bcf1eb42cda72c344f420a64ef7665f1"
    },
    {
      "type": "FIX",
      "url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-wpxj-44w3-2j6x"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-44794 (GCVE-0-2026-44794)

Vulnerability from cvelistv5 – Published: 2026-05-28 17:01 – Updated: 2026-05-30 02:02

Title

Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference

Summary

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-30 02:02 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root Scorecard

References

5 references

URL	Tags
https://github.com/nautobot/nautobot/security/adv…	x_refsource_CONFIRM
https://github.com/nautobot/nautobot/commit/36cde…	x_refsource_MISC
https://github.com/nautobot/nautobot/commit/9918b…	x_refsource_MISC
https://github.com/nautobot/nautobot/releases/tag…	x_refsource_MISC
https://github.com/nautobot/nautobot/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nautobot	nautobot	Affected: >= 3.0.0a2, < 3.1.2 Affected: < 2.4.33

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44794",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-30T02:02:38.997080Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-30T02:02:47.815Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nautobot",
          "vendor": "nautobot",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0a2, \u003c 3.1.2"
            },
            {
              "status": "affected",
              "version": "\u003c 2.4.33"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, in the case of inter-object references via GenericForeignKey (a pattern allowing an object to reference another object that may belong to one of several different \"content types\" or database tables), when creating or updating an object containing a GenericForeignKey, Nautobot\u0027s REST API failed to enforce user \"view\" permissions when determining whether a given reference to another object would be valid. This vulnerability is fixed in 2.4.33 and 3.1.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-28T17:01:21.400Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nautobot/nautobot/security/advisories/GHSA-wpxj-44w3-2j6x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-wpxj-44w3-2j6x"
        },
        {
          "name": "https://github.com/nautobot/nautobot/commit/36cde7148a207234de6212ec074f321dbc9d1b5b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nautobot/nautobot/commit/36cde7148a207234de6212ec074f321dbc9d1b5b"
        },
        {
          "name": "https://github.com/nautobot/nautobot/commit/9918bdb9bcf1eb42cda72c344f420a64ef7665f1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nautobot/nautobot/commit/9918bdb9bcf1eb42cda72c344f420a64ef7665f1"
        },
        {
          "name": "https://github.com/nautobot/nautobot/releases/tag/v2.4.33",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nautobot/nautobot/releases/tag/v2.4.33"
        },
        {
          "name": "https://github.com/nautobot/nautobot/releases/tag/v3.1.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nautobot/nautobot/releases/tag/v3.1.2"
        }
      ],
      "source": {
        "advisory": "GHSA-wpxj-44w3-2j6x",
        "discovery": "UNKNOWN"
      },
      "title": "Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44794",
    "datePublished": "2026-05-28T17:01:21.400Z",
    "dateReserved": "2026-05-07T19:20:44.693Z",
    "dateUpdated": "2026-05-30T02:02:47.815Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GHSA-WPXJ-44W3-2J6X

Vulnerability from github – Published: 2026-05-13 15:30 – Updated: 2026-06-09 02:01

Summary

Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference

Details

Impact

In the case of inter-object references via GenericForeignKey (a pattern allowing an object to reference another object that may belong to one of several different "content types" or database tables), when creating or updating an object containing a GenericForeignKey, Nautobot's REST API failed to enforce user "view" permissions when determining whether a given reference to another object would be valid.

As a concrete example, a user:

who has permission to create or update ImageAttachment records
but who lacks permission to view (some or all) Device records
but who knows (via some other mechanism) the UUID of a specific Device that they do not otherwise have access to

could create via the REST API an ImageAttachment linked to that specific Device.

Other models that use GenericForeignKey and may be writable via the REST API, and hence have a similar vulnerability to ImageAttachment, may include:

ApprovalWorkflow
Cable
ConfigContext
ContactAssociation
DataCompliance
Device
ExportTemplate
GraphQLQuery
Note
ObjectMetadata
RelationshipAssociation
StaticGroupAssociation
VirtualMachine

Additionally, any Nautobot Apps that provide models with a REST API and use GenericForeignKey may have a similar vulnerability for their models.

Patches

A general-purpose fix has been implemented in Nautobot 2.4.33 and 3.1.2, which ensures correct application of "view" permissions when creating or modifying object references via GenericForeignKey throughout the REST API. Individual models/views/serializers generally will not require any specific code changes to benefit from this fix.

Workarounds

No known workarounds at this time.

References

2.4.33 (patch)
3.1.2 (patch)

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "nautobot"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0a2"
            },
            {
              "fixed": "3.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "nautobot"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44794"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-13T15:30:46Z",
    "nvd_published_at": "2026-05-28T18:16:33Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nIn the case of inter-object references via `GenericForeignKey` (a pattern allowing an object to reference another object that may belong to one of several different \"content types\" or database tables), when creating or updating an object containing a `GenericForeignKey`, Nautobot\u0027s REST API failed to enforce user \"view\" permissions when determining whether a given reference to another object would be valid. \n\nAs a concrete example, a user:\n\n- who has permission to create or update `ImageAttachment` records\n- but who lacks permission to view (some or all) `Device` records\n- _but who knows (via some other mechanism) the UUID of a specific `Device` that they do not otherwise have access to_\n\ncould create via the REST API an `ImageAttachment` linked to that specific `Device`.\n\nOther models that use `GenericForeignKey` and may be writable via the REST API, and hence have a similar vulnerability to `ImageAttachment`, may include:\n\n- `ApprovalWorkflow`\n- `Cable`\n- `ConfigContext`\n- `ContactAssociation`\n- `DataCompliance`\n- `Device`\n- `ExportTemplate`\n- `GraphQLQuery`\n- `Note`\n- `ObjectMetadata`\n- `RelationshipAssociation`\n- `StaticGroupAssociation`\n- `VirtualMachine`\n\nAdditionally, any Nautobot Apps that provide models with a REST API and use GenericForeignKey may have a similar vulnerability for their models.\n\n### Patches\n\nA general-purpose fix has been implemented in Nautobot 2.4.33 and 3.1.2, which ensures correct application of \"view\" permissions when creating or modifying object references via `GenericForeignKey` throughout the REST API. Individual models/views/serializers generally will not require any specific code changes to benefit from this fix.\n\n### Workarounds\n\nNo known workarounds at this time.\n\n### References\n\n- 2.4.33 (\u003ca href=\"https://github.com/nautobot/nautobot/commit/9918bdb9bcf1eb42cda72c344f420a64ef7665f1\"\u003epatch\u003c/a\u003e)\n- 3.1.2 (\u003ca href=\"https://github.com/nautobot/nautobot/commit/36cde7148a207234de6212ec074f321dbc9d1b5b\"\u003epatch\u003c/a\u003e)",
  "id": "GHSA-wpxj-44w3-2j6x",
  "modified": "2026-06-09T02:01:03Z",
  "published": "2026-05-13T15:30:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-wpxj-44w3-2j6x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44794"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nautobot/nautobot/commit/36cde7148a207234de6212ec074f321dbc9d1b5b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nautobot/nautobot/commit/9918bdb9bcf1eb42cda72c344f420a64ef7665f1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nautobot/nautobot"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nautobot/nautobot/releases/tag/v2.4.33"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nautobot/nautobot/releases/tag/v3.1.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

PYSEC-2026-2225

CVE-2026-44794 (GCVE-0-2026-44794)

GHSA-WPXJ-44W3-2J6X

Impact

Patches

Workarounds

References

Tags

Sightings

Nomenclature

Related by attack behaviour