Executive brief
Nautobot is a platform used for managing network infrastructure and automation. A vulnerability in its API allows users with basic permissions to modify internal data fields that should be read-only. An attacker could use this to force the system to use incorrect or malicious versions of configuration files, potentially leading to a loss of control over network automation or a complete service outage.
Technical details
A vulnerability classified as CWE-471 (Modification of Assumed-Immutable Data) exists in Nautobot's REST API. The 'current_head' field of a GitRepository record, which is intended to be internal and read-only, is incorrectly writable. An authenticated attacker with permissions to add or change GitRepository records can use the API to manually set this field to an arbitrary commit hash or malformed value. This can force Nautobot to check out an incorrect commit, leading to a misleading operational state, or cause the repository integration to fail entirely. The issue is fixed in versions 2.4.33 and 3.1.2.
Affected products
- Nautobot Nautobot < 2.4.33, >= 3.0.0a2, < 3.1.2
Timeline
- 2026-05-08: disclosed: Initial disclosure by reporter
- 2026-05-13: advisory: GitHub Advisory published
- 2026-05-28: other: NVD published