Threat Intelligence Database

Netmaker versions up to 1.6.0 disable TLS certificate verification when connecting to the configured mail server. This unconditional skip of certificate validation allows an attacker positioned between Netmaker and its mail relay to intercept and read sensitive emails, including password reset tokens and user invitations. The vulnerability arises because no configuration or code path enforces certificate verification in production, exposing sensitive data in transit.

Netmaker makes networks with WireGuard. Prior to version 1.5.0, a user assigned the platform-user role can retrieve WireGuard private keys of all wireguard configs in a network by calling GET /api/extclients/{network} or GET /api/nodes/{network}. While the Netmaker UI restricts visibility, the API endpoints return full records, including private keys, without filtering based on the requesting user's ownership. This issue has been patched in version 1.5.0.

HighVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2026-29196#cwe-863

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the user update handler (PUT /api/users/{username}) lacks validation to prevent an admin-role user from assigning the super-admin role during account updates. While the code correctly blocks an admin from assigning the admin role to another user, it does not include an equivalent check for the super-admin role. This issue has been patched in version 1.5.0.

MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2026-29195#cwe-863

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the Authorize middleware in Netmaker incorrectly validates host JWT tokens. When a route permits host authentication (hostAllowed=true), a valid host token bypasses all subsequent authorization checks without verifying that the host is authorized to access the specific requested resource. Any entity possessing knowledge of object identifiers (node IDs, host IDs) can craft a request with an arbitrary valid host token to access, modify, or delete resources belonging to other hosts. Affected endpoints include node info retrieval, host deletion, MQTT signal transmission, fallback host updates, and failover operations. This issue has been patched in version 1.5.0.

HighVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2026-29194#cwe-863

Netmaker makes networks with WireGuard. Prior to version 1.2.0, the /api/server/shutdown endpoint allows termination of the Netmaker server process via syscall.SIGINT. This allows any user to repeatedly shut down the server, causing cyclic denial of service with approximately 3-second restart intervals. This issue has been patched in version 1.2.0.

HighVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2026-29771#cwe-404