CVE-2026-44797: Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)

Synopsis

This is a server-side request forgery (SSRF) vulnerability in Nautobot, a network automation and source-of-truth platform. An authenticated user with sufficient access to manage Webhook definitions can craft webhook configurations that cause the Nautobot server to send HTTP requests to arbitrary internal or restricted hosts, bypassing network controls the server would normally respect. Successful exploitation allows an attacker to read sensitive data from internal services and make limited modifications via outbound requests. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as fix versions 2.4.33 or 3.1.2 are published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Nautobot web interface over the network; the service must be exposed to the attacker's network segment.

• AuthenticationRequired

  The attacker must hold a valid Nautobot account with sufficient privileges to create or modify Webhook definitions; any low-privilege account granted that permission is sufficient.

• Victim interactionNot required

  No other user needs to take any action; the attacker configures the malicious webhook directly and triggers it without any victim involvement.

• Attack complexityDetail

  Exploitation is straightforward and condition-free: once the attacker has the necessary account access, crafting a malicious webhook requires no race conditions or special environmental setup.

Blast Radius

• The Nautobot server sends HTTP requests to internal hosts or IP ranges that should be unreachable from the public network, exposing internal services to enumeration and data extraction.
• The attacker reads responses from internal HTTP endpoints, which may include stored credentials, API tokens, configuration data, or metadata service payloads (such as cloud instance metadata at 169.254.169.254).
• The CVSS Integrity score of Low reflects that outbound webhook requests may also trigger state changes on internal services that accept unauthenticated or lightly authenticated HTTP calls, allowing limited data modification.
• Network segmentation controls placed in front of internal services are bypassed because the requests originate from the trusted Nautobot server process itself.