CVE-2026-81034: Improper Certificate Validation in gravitl netmaker

CVE-2026-81034 describes an improper certificate validation vulnerability in gravitl Netmaker. In the SMTP client code (pro/email/smtp.go), the TLS configuration unconditionally sets the skip-verify flag to true, disabling certificate verification for connections to the mail server. This flaw means Netmaker accepts any TLS certificate presented, including those from man-in-the-middle attackers. Sensitive emails containing password reset tokens and enrollment links can be intercepted and exploited by an attacker on the network path. The issue is present in released versions up to and including 1.6.0 and is absent from the development branch.

An attacker able to intercept network traffic between Netmaker and its mail server can read sensitive email contents, including single-use password reset tokens and user enrollment links. This exposure can lead to unauthorized account access or enrollment, compromising user security. The vulnerability does not require user interaction and can be exploited remotely without privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using affected versions or configure mail server connections in a way that enforces certificate validation externally. Monitor vendor communications for updates addressing this issue.