{"items":[{"id":"NVI-00018606","kind":"vulnerability","title":"Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-c35q-vxrp-ph26","CVE-2026-44797"],"plain_summary":"GitHub lists this reviewed advisory for nautobot, nautobot. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-4334c9c8d6fc629a05d9691dbdcd733c"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-09T10:18:42.000Z","value":"8.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-4334c9c8d6fc629a05d9691dbdcd733c"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-4334c9c8d6fc629a05d9691dbdcd733c","url":"https://github.com/advisories/GHSA-c35q-vxrp-ph26","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-c35q-vxrp-ph26","publisher":"GitHub Advisory Database","observed_at":"2026-11-06T20:58:31.464Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-4334c9c8d6fc629a05d9691dbdcd733c"],"technology":"nautobot","known_exclusions":[],"conditions_summary":"### Impact\n\nNautobot's `Webhook` data model and associated feature set could be configured by users with sufficient access to perform requests to various hosts and IP addresses that should not be permitted, allowing for various behaviors similar to server-side request forgery (SSRF).\n\n### Patches\n\nFixes are available in Nautobot v2.4.33 and v3.1.2.\n\nIn support of this fix, three new settings variables have been added to Nautobot:\n\n- `WEBHOOK_ALLOWED_SCHEMES` - By default new or updated `Webhook` records will be restricted to HTTP or HTTPS only, disallowing other schemes that may have been previously allowed. Administrators should audit existing `Webhook` records to identify any that are invalid, and either update/delete said records or customize `WEBHOOK_ALLOWED_SCHEMES` as appropriate.\n- `WEBHOOK_ADDITIONAL_BLOCKED_NETWORKS` - This can be used to specify additional IP networks that should be denied to `Webhook` sending, for example some deployments may wish to disallow RFC1918 addresses or even disallow all networks and carve out specific exemptions using the following setting.\n- `WEBHOOK_ALLOWED_HOSTS` - This can be used to provide an allow-list of specific hosts that would other","public_affected_ranges":[">= 3.0.0a2, < 3.1.2"]},{"certainty":"source_listed","source_ids":["sr-4334c9c8d6fc629a05d9691dbdcd733c"],"technology":"nautobot","known_exclusions":[],"conditions_summary":"### Impact\n\nNautobot's `Webhook` data model and associated feature set could be configured by users with sufficient access to perform requests to various hosts and IP addresses that should not be permitted, allowing for various behaviors similar to server-side request forgery (SSRF).\n\n### Patches\n\nFixes are available in Nautobot v2.4.33 and v3.1.2.\n\nIn support of this fix, three new settings variables have been added to Nautobot:\n\n- `WEBHOOK_ALLOWED_SCHEMES` - By default new or updated `Webhook` records will be restricted to HTTP or HTTPS only, disallowing other schemes that may have been previously allowed. Administrators should audit existing `Webhook` records to identify any that are invalid, and either update/delete said records or customize `WEBHOOK_ALLOWED_SCHEMES` as appropriate.\n- `WEBHOOK_ADDITIONAL_BLOCKED_NETWORKS` - This can be used to specify additional IP networks that should be denied to `Webhook` sending, for example some deployments may wish to disallow RFC1918 addresses or even disallow all networks and carve out specific exemptions using the following setting.\n- `WEBHOOK_ALLOWED_HOSTS` - This can be used to provide an allow-list of specific hosts that would other","public_affected_ranges":["< 2.4.33"]}],"null_published_at":"2026-11-07T07:07:39.861Z","source_updated_at":"2026-06-09T10:18:42.000Z","source_disclosed_at":"2026-05-13T15:30:59.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-06T20:58:31.464Z"}],"next_cursor":null,"snapshot_revision":"42594"}