Is CVE-2026-44794 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44794 being exploited in the wild.

How severe is CVE-2026-44794?

Medium severity, with a CVSS score of 5.4, published 28 May 2026.

Which products and versions are affected?

nautobot (PyPI) ECOSYSTEM:introduced=0,fixed=2.4.33,introduced=3.0.0,fixed=3.1.2, ECOSYSTEM:introduced=3.0.0a2,fixed=3.1.2.

Is there a fix for CVE-2026-44794?

Yes. nautobot (PyPI): upgrade to 3.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44794 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-44794?

Check whether you run nautobot (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44794: Nautobot missing authorization in REST API GenericForeignKey references

CVE-2026-44794 · Severity: medium · CVSS 5.4 · Published 2026-05-28

Nautobot, a network source of truth and automation platform, contains a vulnerability in its REST API regarding how it handles links between different types of data. An authorized user could create or update records that reference sensitive objects (such as specific network devices) even if they do not have permission to view those objects. This could allow a user to bypass intended access controls and associate data with infrastructure they should not be able to interact with.

Technologies: nautobot (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-44794 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44794 being exploited in the wild.
How severe is CVE-2026-44794?: Medium severity, with a CVSS score of 5.4, published 28 May 2026.
Which products and versions are affected?: nautobot (PyPI) ECOSYSTEM:introduced=0,fixed=2.4.33,introduced=3.0.0,fixed=3.1.2, ECOSYSTEM:introduced=3.0.0a2,fixed=3.1.2.
Is there a fix for CVE-2026-44794?: Yes. nautobot (PyPI): upgrade to 3.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44794 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44794?: Check whether you run nautobot (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nautobot (PyPI): upgrade to 3.1.2 or later
```
pip install "nautobot>=3.1.2"
```

Technical details

A missing authorization check (CWE-862) exists in the Nautobot REST API's handling of GenericForeignKey fields. When a user creates or updates a model containing a GenericForeignKey (such as ImageAttachment, Cable, or Device), the API fails to verify if the user has 'view' permissions for the target object being referenced. If an attacker knows the UUID of a target object they cannot normally access, they can successfully create a reference to it. This affects multiple core models and potentially third-party Nautobot Apps. The issue is resolved in versions 2.4.33 and 3.1.2 by implementing a general-purpose fix that ensures 'view' permissions are validated during object reference creation or modification.

Affected products

Network to Code Nautobot < 2.4.33, >= 3.0.0a2, < 3.1.2

Identifiers

CVE-2026-44794
GHSA-wpxj-44w3-2j6x
PYSEC-2026-2225

Timeline

2026-05-08: disclosed: Initial disclosure on GitHub
2026-05-13: advisory: GitHub Advisory published
2026-05-28: other: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.