Skip to content

README.md

Latest commit

 

History

History
36 lines (24 loc) · 5.35 KB

README.md

File metadata and controls

36 lines (24 loc) · 5.35 KB
Raw

Nautobot — Security Research

Nautobot is an open-source Network Source-of-Truth and automation platform built on Django. It backs operational tooling for networking teams: device/interface/cable inventory, IP address management, automation triggers (Jobs, Webhooks), and a REST + GraphQL API on top of all of it.

The findings below were disclosed through GitHub Security Advisories on the nautobot/nautobot repository and patched together in releases 2.4.33 and 3.1.2 (both shipped 2026-05-08). All three are exploitable by authenticated, non-admin users with permissions that are routinely delegated to network engineers / integrations admins — none require superuser.

Findings

CVE Severity Class Auth Required One-line
CVE-2026-44797 High 8.5 SSRF (CWE-918) extras.add_webhook / change_webhook Webhook target URL is sent unchecked from the worker — loopback / link-local / cloud-metadata / RFC1918 reachable, with no DNS re-check
CVE-2026-44796 Moderate 6.5 ReDoS (CWE-1333 / CWE-400) change_<model> on any bulk-rename target (Interface, Device, Cable, …) Bulk-rename use_regex runs re.sub() with no timeout; (a+)+$ on a ~30-char name pins a worker until Gunicorn kills it
CVE-2026-44794 Moderate 5.4 Missing Authorization (CWE-862) add_/change_<model> on any GFK-bearing model (Note, ContactAssociation, ImageAttachment, Cable, …) REST API GenericForeignKey validator does not apply restrict(user, "view") — write-side reference to any UUID, regardless of read permission; doubles as an existence oracle

Common context

  • Affected: nautobot < 2.4.33 (the 2.4.x stable line) and < 3.1.2 (the 3.x line).
  • Fixed: v2.4.33 and v3.1.2, released 2026-05-08.
  • Disclosure window: all three GHSAs published 2026-05-08; patches and CVE assignments shipped the same day.
  • Adjacent advisory (different reporter, same release): GHSA-p3hx-pwf3-j8wr / CVE-2026-44798 — GitRepository.current_head writable through REST API. Reported by @holmie; not covered in this write-up cluster.

Themes

  • "Authenticated, non-admin" is the realistic threat model for ops platforms. Every finding here is gated by a permission that operators routinely delegate: webhook write, bulk-rename write, GFK-bearing-model write. The Nautobot threat model that "you only run this internally for trusted network engineers" papers over the fact that those engineers' accounts are exactly the credentials phishers go after. Bugs that require an attacker to be a superuser are mostly theoretical; bugs that require a webhook-admin role are operational.
  • Worker-side outbound HTTP is SSRF surface. CVE-2026-44797 is the canonical case: a feature that issues server-side HTTP requests on user-controlled URLs, with no scheme allow-list, no IP block-list, and no send-time DNS re-check. The fix introduces both a save-time validator and a send-time validator (the latter re-resolves DNS before issuing the request), which is the right defence-in-depth posture against rebinding.
  • User-controlled regex without a timeout is a one-shot DoS. CVE-2026-44796 hits the well-known Python re ReDoS pitfall — the standard library has no timeout= and no way to cancel a running match. The fix swaps to the regex library specifically because of its timeout= kwarg. Anywhere else in the codebase (or in any other Django project) that takes a user-controlled pattern, the same retrofit applies.
  • Write-side authorization needs the same restrictions as read-side. CVE-2026-44794 is the structural shape that recurs in any Django app that uses GenericForeignKey: the validator only checked Model.objects.get(pk=...) — the unrestricted manager — when the rest of the codebase consistently used Model.objects.restrict(user, "view"). The right invariant is "any user-controlled lookup goes through restrict()", and the fix correctly centralises the new check in the base serializer so the next GFK addition inherits the protection automatically.
  • Centralise security predicates so future code review has one line to point at. All three fixes pull the security check up to a shared layer (a new nautobot/extras/webhooks.py validator, a base-class BulkRenameView timeout attribute, the base-class GFK validator) instead of patching each call site. That's the maintainable shape of a security fix — the alternative (per-callsite checks) is the very pattern that produces the next CVE.

Reporter

Found and reported by @whatisproblem.

Acknowledgement

Thanks to the Nautobot maintainers (@nautobot) for prompt triage and for landing all three fixes alongside a fourth advisory (CVE-2026-44798) in a single coordinated release. The Webhook SSRF mitigation in particular is a clean piece of defensive engineering — splitting save-time and send-time validation, with a non-overridable built-in block-list distinct from the operator-extensible one, is the textbook shape for this class of fix.