CVE-2026-38651
HighSummary
An authentication bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validate the JWT signature when verifying host tokens, allowing an attacker to forge a JWT and impersonate any host in the network.
Risk Assessment
An attacker can gain access to sensitive information by impersonating other hosts in the network, posing a serious security threat to the organization.
Recommendation
It is recommended to upgrade to Netmaker version 1.5.0 or later to mitigate this vulnerability and implement additional security measures to protect against unauthorized access.
Other vulnerabilities in Netmaker
See all- CVE-2023-32079High
A mass assignment vulnerability was found in Netmaker, which creates networks with WireGuard, in versions prior to 0.17.1 and 0.18.6 that allows a non-admin user to escalate privileges to those of an admin user.
- CVE-2023-32078High
In Netmaker, which creates networks with WireGuard, an Insecure Direct Object Reference (IDOR) vulnerability was found in the user update function in versions prior to 0.17.1 and 0.18.6. It allows updating another user's password by specifying their username.
- CVE-2023-32077High
In Netmaker, prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage was found, allowing unauth users to interact with DNS API endpoints. The issue is patched in versions 0.17.1 and 0.18.6.
- CVE-2022-36110High
Netmaker prior to version 0.15.1 had an improper authorization issue that allowed non-privileged users to execute privileged API calls. Users added to the Netmaker platform without admin privileges could use their auth tokens to run admin-level functions via the API.
- CVE-2026-81034Medium
Netmaker disables certificate verification on the connection to the configured mail server. The skip-verify field is set to true unconditionally, allowing the client to accept any certificate, including one from an interposing party. Mail sent by Netmaker includes password-reset messages with single-use tokens and user invitations with enrolment links, which can be intercepted.
Original NVD description (English source)
Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validate the JWT signature when verifying host tokens. An attacker can forge a JWT signed with any arbitrary key and use it to impersonate any host in the network, gaining access to sensitive information