The Nautobot platform allowed a REST API user with permission to modify GitRepository objects to set the current_head field directly. This field is intended to be managed internally and not editable by end users. By changing it, an attacker can force Nautobot’s local clone to checkout a commit that is not the latest on the target branch or point it to a nonexistent or malformed commit hash. The resulting misleading state or inability to access the repository undermines the accuracy of network automation tasks and can lead to incorrect device configuration changes.

Nautobot Network Automation Platform distributes versions before 2.4.33 and 3.1.2 as affected. The vulnerability applies to any instance where REST API write access to GitRepository models is enabled. No additional products are listed.

The CVSS score is 7.1, indicating a moderate to high risk. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Attackers must first authenticate to the REST API and have permissions to edit GitRepository records, after which they can set an arbitrary current_head value. Patch releases 2.4.33 and 3.1.2 fix the issue by making current_head read‑only via the API.