The vulnerability allows users with sufficient Nautobot privileges to configure webhook definitions that can issue HTTP requests to arbitrary hosts and IP addresses. This capability effectively results in a server‑side request forgery (SSRF) which could let an attacker read internal network resources, exfiltrate sensitive data, or interact with internal services without direct network access. The weakness is identified as CWE‑918.

Vendor Nautobot. Product Nautobot Network Source of Truth and Automation Platform. Affected releases are all versions prior to 2.4.33 for the 2.x line and before 3.1.2 for the 3.x line; audited fixes are available in those releases.

The CVSS base score of 8.5 marks this as high severity. No EPSS score is supplied, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker have the ability to create or modify webhook definitions, typically implying at least a high‑privileged Nautobot user. Once the user defines a malicious webhook, the server performs outbound requests to attacker‑chosen destinations, enabling further lateral movement or data exfiltration within the internal network.