Nautobot EUVD-2026-32973

Attacker must possess valid Nautobot credentials with Django permissions extras.add_gitrepository or extras.change_gitrepository (typically granted to infrastructure administrators or automation service accounts). Exploitation requires direct REST API access to the /api/extras/git-repositories/ endpoint with the ability to send authenticated PATCH or PUT requests. The GitRepository feature must be enabled and in use for data sources (default in typical Nautobot deployments for config-as-code workflows). Attack succeeds against default API configurations with no special network positioning beyond reaching the Nautobot web service. The vendor notes that users with these permission levels can already cause similar impact by legitimately modifying branch or remote_url fields, indicating the vulnerability extends rather than creates new attack surface for this privilege tier.

Real-world risk is moderate despite the 7.1 CVSS score. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-accessible exploitation requiring low-privilege authentication with no user interaction. However, the attack requires GitRepository object modification permissions, which are typically restricted to infrastructure/automation administrators rather than general users. The High availability impact (A:H) reflects potential denial of service - malformed current_head values can render repositories unusable until manual remediation. The Low integrity impact (I:L) reflects state confusion rather than code execution. No EPSS or KEV data provided, suggesting no evidence of active exploitation. The vendor advisory notes that users with the same permission level can already cause similar disruption by changing branch or remote_url fields, indicating this vulnerability extends rather than creates an attack surface. Patch availability is confirmed with specific fix versions (2.4.33, 3.1.2) and GitHub commit references. Priority should be guided by how tightly GitRepository permissions are restricted in your deployment - installations following least-privilege principles face lower practical risk than those with broad administrative access.

An authenticated user with GitRepository modification privileges accesses the Nautobot REST API at /api/extras/git-repositories/ and issues a PATCH request setting current_head to a nonexistent commit hash (e.g., all zeros or random hex). On the next repository sync operation, Nautobot's GitRepo helper attempts to checkout this invalid commit, causing git command failures and rendering the repository unusable for data source operations. Alternatively, setting current_head to a valid but outdated commit causes Nautobot to serve stale configuration data while reporting the repository as successfully synced, creating misleading operational state for network automation workflows.