CVE-2026-115325: Authorization Bypass Through User-Controlled Key in gravitl netmaker

CVE-2026-115325 describes an authorization bypass in Netmaker through version 1.7.0. The vulnerability exists in the updateExtClient handler, which improperly restricts user permissions. Network-scoped users with external client permissions on one network can send PUT requests to /api/extclients/{network}/{clientid} targeting other networks. This enables attackers to replace public keys, disable external clients, and obtain sensitive WireGuard private keys, compromising network security.

An attacker with external client permissions on a single network can manipulate external clients on other networks, leading to unauthorized modification of client configurations, disabling of clients, and exposure of private WireGuard keys. This can result in significant compromise of network confidentiality and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict external client permissions to trusted users only and monitor API access for suspicious PUT requests targeting external clients on other networks.