CVE-2026-44798

The record

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, a user with access to add/change a GitRepository record could use the REST API to directly set the current_head field on the record, which was not intended to be user-editable. Doing so could cause Nautobot's local clone(s) of the relevant repository to checkout a commit other than the latest commit on the specified branch (resulting in misleading state), or potentially to be unable to make use of the repository at all (until manually remediated) due to the current_head pointing to a nonexistent commit hash or malformed value. This vulnerability is fixed in 2.4.33 and 3.1.2.

Affected packages

Related vulnerabilities

• CVE-2026-103001 PyJWT is a Python implementation of JSON Web Token standards. CWE-471
• CVE-2026-92949 vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor… CWE-471
• CVE-2026-84664 Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection… CWE-471
• CVE-2026-59299 Composition lookup can potentially poison base function in Spring Cloud Function. CWE-471
• CVE-2026-54267 Angular is a development platform for building mobile and desktop web applications using… CWE-471
• GHSA-cmwh-pvxp-8882 DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook… CWE-471
• GHSA-rgjc-h3x7-9mwg Angular Client Hydration DOM Clobbering & Response-Cache Poisoning CWE-471
• CVE-2026-8492 Modification of Assumed-Immutable Data (MAID) vulnerability in Drupal Translate Drupal… CWE-471