{"id":"CVE-2026-44798","aliases":["GHSA-p3hx-pwf3-j8wr","PYSEC-2026-2228"],"title":"Nautobot: GitRepository.current_head field should not be writable through REST API","summary":"Nautobot: GitRepository.current_head field should not be writable through REST API","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","vendor":"nautobot","product":"nautobot","ecosystem":"pip","affected":["nautobot >= 3.0.0a2, < 3.1.2","nautobot < 2.4.33"],"patched":["nautobot 3.1.2","nautobot 2.4.33"],"published":"2026-05-13","updated":"2026-07-13","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-p3hx-pwf3-j8wr","references":[{"url":"https://github.com/nautobot/nautobot/security/advisories/GHSA-p3hx-pwf3-j8wr"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44798"},{"url":"https://github.com/nautobot/nautobot/commit/9deddfc91ad9260ad17b5e20084e9e2d15be3609"},{"url":"https://github.com/nautobot/nautobot/commit/c46f97040b2bde4320be36b23577f19a8bcbd8c3"},{"url":"https://github.com/nautobot/nautobot"},{"url":"https://github.com/nautobot/nautobot/releases/tag/v2.4.33"},{"url":"https://github.com/nautobot/nautobot/releases/tag/v3.1.2"}],"tags":["osv","pip"],"epss":0.00277,"epssPercentile":0.20395,"ingestedAt":"2026-07-13T18:58:01.127Z","slug":"CVE-2026-44798","body":"## Overview\n\n### Impact\n\nA user with access to add/change a GitRepository record could use the REST API to directly set the `current_head` field on the record, which was not intended to be user-editable. Doing so could cause Nautobot's local clone(s) of the relevant repository to checkout a commit other than the latest commit on the specified `branch` (resulting in misleading state), or potentially to be unable to make use of the repository at all (until manually remediated) due to the `current_head` pointing to a nonexistent commit hash or malformed value.\n\n### Patches\n\nThe issue has been remediated in Nautobot v2.4.33 and 3.1.2.\n\n\n### Workarounds\n\nNote that many of the same end-result symptoms could be caused by a user with the same level of access simply changing the `branch` or `remote_url` of a GitRepository rather than crafting the `current_head`. Administrators are encouraged to carefully review which users are granted permissions to create and modify GitRepository records.\n\n\n### References\n\n- 2.4.33 (<a href=\"https://github.com/nautobot/nautobot/commit/9deddfc91ad9260ad17b5e20084e9e2d15be3609\">patch</a>)\n- 3.1.2 (<a href=\"https://github.com/nautobot/nautobot/commit/c46f97040b2bde4320be36b23577f19a8bcbd8c3\">patch</a>)\n\n## Affected packages\n\n- `nautobot >= 3.0.0a2, < 3.1.2`\n- `nautobot < 2.4.33`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `nautobot 3.1.2`\n- `nautobot 2.4.33`","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}