Threat database

Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks. Attackers with external client permissions on one network can send PUT requests to /api/extclients/{network}/{clientid} to replace public keys, disable clients, and obtain WireGuard private keys.

CVE-2026-32599 is a medium severity SQL injection vulnerability in gravitl netmaker prior to version 1.5.0. The issue arises from the sqliteDeleteRecord function, which constructs SQL DELETE statements using direct string concatenation of user input, allowing an authenticated attacker to perform boolean-based SQL injection. This vulnerability is fixed in version 1.5.0.

Netmaker versions up to 1.6.0 disable TLS certificate verification when connecting to the configured mail server. This unconditional skip of certificate validation allows an attacker positioned between Netmaker and its mail relay to intercept and read sensitive emails, including password reset tokens and user invitations. The vulnerability arises because no configuration or code path enforces certificate verification in production, exposing sensitive data in transit.

CVE-2026-54617 is a critical path traversal vulnerability in GravitLauncher, an open-source Minecraft launcher. Versions prior to 5.7.12 allow unauthenticated remote attackers to send specially crafted HTTP requests without a leading slash to the LaunchServer file server on port 9274. This flaw enables reading arbitrary files accessible to the LaunchServer process, including sensitive signing keys and credentials. Exploitation can lead to forged administrative tokens and full authentication bypass. The issue is fixed in version 5.7.12.

Netmaker makes networks with WireGuard. Prior to version 1.5.0, a user assigned the platform-user role can retrieve WireGuard private keys of all wireguard configs in a network by calling GET /api/extclients/{network} or GET /api/nodes/{network}. While the Netmaker UI restricts visibility, the API endpoints return full records, including private keys, without filtering based on the requesting user's ownership. This issue has been patched in version 1.5.0.

EPSS 0.3%Vulnerabilitygravitl#cwe-863United States+9

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the user update handler (PUT /api/users/{username}) lacks validation to prevent an admin-role user from assigning the super-admin role during account updates. While the code correctly blocks an admin from assigning the admin role to another user, it does not include an equivalent check for the super-admin role. This issue has been patched in version 1.5.0.

EPSS 0.3%Vulnerabilitygravitl#cwe-863United States+9

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the Authorize middleware in Netmaker incorrectly validates host JWT tokens. When a route permits host authentication (hostAllowed=true), a valid host token bypasses all subsequent authorization checks without verifying that the host is authorized to access the specific requested resource. Any entity possessing knowledge of object identifiers (node IDs, host IDs) can craft a request with an arbitrary valid host token to access, modify, or delete resources belonging to other hosts. Affected endpoints include node info retrieval, host deletion, MQTT signal transmission, fallback host updates, and failover operations. This issue has been patched in version 1.5.0.

EPSS 0.5%Vulnerabilitygravitl#cwe-863United States+9

Netmaker makes networks with WireGuard. Prior to version 1.2.0, the /api/server/shutdown endpoint allows termination of the Netmaker server process via syscall.SIGINT. This allows any user to repeatedly shut down the server, causing cyclic denial of service with approximately 3-second restart intervals. This issue has been patched in version 1.2.0.

EPSS 0.5%Vulnerabilitygravitl#cwe-404United States+9