CVE-2026-115325

An authentication bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validate the JWT signature when verifying host tokens, allowing an attacker to forge a JWT and impersonate any host in the network.

A mass assignment vulnerability was found in Netmaker, which creates networks with WireGuard, in versions prior to 0.17.1 and 0.18.6 that allows a non-admin user to escalate privileges to those of an admin user.

In Netmaker, which creates networks with WireGuard, an Insecure Direct Object Reference (IDOR) vulnerability was found in the user update function in versions prior to 0.17.1 and 0.18.6. It allows updating another user's password by specifying their username.

In Netmaker, prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage was found, allowing unauth users to interact with DNS API endpoints. The issue is patched in versions 0.17.1 and 0.18.6.

Netmaker prior to version 0.15.1 had an improper authorization issue that allowed non-privileged users to execute privileged API calls. Users added to the Netmaker platform without admin privileges could use their auth tokens to run admin-level functions via the API.

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the sqliteDeleteRecord function in Netmaker's database layer constructs SQL DELETE statements using direct string concatenation of user-supplied input. This allows an authenticated attacker to perform boolean-based SQL injection.

Netmaker disables certificate verification on the connection to the configured mail server. The skip-verify field is set to true unconditionally, allowing the client to accept any certificate, including one from an interposing party. Mail sent by Netmaker includes password-reset messages with single-use tokens and user invitations with enrolment links, which can be intercepted.