CVE-2026-44798

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, a user with access to add/change a GitRepository record could use the REST API to directly set the current_head field on the record, which was not intended to be user-editable. Doing so could cause Nautobot's local clone(s) of the relevant repository to checkout a commit other than the latest commit on the specified branch (resulting in misleading state), or potentially to be unable to make use of the repository at all (until manually remediated) due to the current_head pointing to a nonexistent commit hash or malformed value. This vulnerability is fixed in 2.4.33 and 3.1.2.

• CWE-471
• CWE-749

• https://github.com/nautobot/nautobot/commit/9deddfc91ad9260ad17b5e20084e9e2d15be3609Patch
• https://github.com/nautobot/nautobot/commit/c46f97040b2bde4320be36b23577f19a8bcbd8c3Patch
• https://github.com/nautobot/nautobot/releases/tag/v2.4.33Product, Release Notes
• https://github.com/nautobot/nautobot/releases/tag/v3.1.2Product, Release Notes
• https://github.com/nautobot/nautobot/security/advisories/GHSA-p3hx-pwf3-j8wrMitigation, Patch, Vendor Advisory

Published

May 28, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44791n8n is an open source workflow automation platform. Prior to…9.9
• CVE-2026-44792n8n is an open source workflow automation platform. Prior to…9
• CVE-2026-44794Nautobot is a Network Source of Truth and Network Automation…5.4
• CVE-2026-44795Spinnaker is an open source, multi-cloud continuous delivery…8.8
• CVE-2026-44796Nautobot is a Network Source of Truth and Network Automation…6.5
• CVE-2026-44797Nautobot is a Network Source of Truth and Network Automation…8.5
• CVE-2026-44799Heap-based buffer overflow in Remote Desktop Client allows a…7.5
• CVE-2026-4480A flaw was found in the Samba printing subsystem. Samba pass…9
• CVE-2026-44800Concurrent execution using shared resource with improper syn…7.8
• CVE-2026-44801Use after free in Remote Desktop Client allows an unauthoriz…7.5
• CVE-2026-44802Use after free in Windows DWM Core Library allows an authori…7.8
• CVE-2026-44803Integer overflow or wraparound in Windows Win32K - GRFX allo…7.8