---
id: CVE-2026-44798
aliases:
  - GHSA-p3hx-pwf3-j8wr
  - PYSEC-2026-2228
title: >-
  Nautobot: GitRepository.current_head field should not be writable through REST
  API
summary: >-
  Nautobot: GitRepository.current_head field should not be writable through REST
  API
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H'
vendor: nautobot
product: nautobot
ecosystem: pip
affected:
  - 'nautobot >= 3.0.0a2, < 3.1.2'
  - nautobot < 2.4.33
patched:
  - nautobot 3.1.2
  - nautobot 2.4.33
published: '2026-05-13'
updated: '2026-07-13'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-p3hx-pwf3-j8wr'
references:
  - url: >-
      https://github.com/nautobot/nautobot/security/advisories/GHSA-p3hx-pwf3-j8wr
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-44798'
  - url: >-
      https://github.com/nautobot/nautobot/commit/9deddfc91ad9260ad17b5e20084e9e2d15be3609
  - url: >-
      https://github.com/nautobot/nautobot/commit/c46f97040b2bde4320be36b23577f19a8bcbd8c3
  - url: 'https://github.com/nautobot/nautobot'
  - url: 'https://github.com/nautobot/nautobot/releases/tag/v2.4.33'
  - url: 'https://github.com/nautobot/nautobot/releases/tag/v3.1.2'
tags:
  - osv
  - pip
epss: 0.00498
epssPercentile: 0.40124
ingestedAt: '2026-07-13T18:58:01.127Z'
---

## Overview

### Impact

A user with access to add/change a GitRepository record could use the REST API to directly set the `current_head` field on the record, which was not intended to be user-editable. Doing so could cause Nautobot's local clone(s) of the relevant repository to checkout a commit other than the latest commit on the specified `branch` (resulting in misleading state), or potentially to be unable to make use of the repository at all (until manually remediated) due to the `current_head` pointing to a nonexistent commit hash or malformed value.

### Patches

The issue has been remediated in Nautobot v2.4.33 and 3.1.2.


### Workarounds

Note that many of the same end-result symptoms could be caused by a user with the same level of access simply changing the `branch` or `remote_url` of a GitRepository rather than crafting the `current_head`. Administrators are encouraged to carefully review which users are granted permissions to create and modify GitRepository records.


### References

- 2.4.33 (<a href="https://github.com/nautobot/nautobot/commit/9deddfc91ad9260ad17b5e20084e9e2d15be3609">patch</a>)
- 3.1.2 (<a href="https://github.com/nautobot/nautobot/commit/c46f97040b2bde4320be36b23577f19a8bcbd8c3">patch</a>)

## Affected packages

- `nautobot >= 3.0.0a2, < 3.1.2`
- `nautobot < 2.4.33`

## Remediation

Upgrade to a patched release:

- `nautobot 3.1.2`
- `nautobot 2.4.33`