Read the docs
TI-2026-23311 Aliases CVE-2026-29194GHSA-hmqr-wjmj-376c

Netmaker: Insufficient Authorization in Host Token Verification

Priority MEDIUM 40CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the Authorize middleware in Netmaker incorrectly validates host JWT tokens. When a route permits host authentication (hostAllowed=true), a valid host token bypasses all subsequent authorization checks without verifying that the host is authorized to access the specific requested resource. Any entity possessing knowledge of object identifiers (node IDs, host IDs) can craft a request with an arbitrary valid host token to access, modify, or delete resources belonging to other hosts. Affected endpoints include node info retrieval, host deletion, MQTT signal transmission, fallback host updates, and failover operations. This issue has been patched in version 1.5.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00471 40th percentileScored 2026-11-07
Fix Fixed netmaker (gravitl): 1.5.0github.com/gravitl/netmaker (Go): 1.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gravitlnetmakerbefore 1.5.01.5.0Patch availableCNA
—github.com/gravitl/netmaker (Go)before 1.5.01.5.0Patch availableGHSA-hmqr-wjmj-376c
  • netmaker Vendorgravitl Affected before 1.5.0 Fixed in 1.5.0 Patch available CNA
  • github.com/gravitl/netmaker (Go) Vendor— Affected before 1.5.0 Fixed in 1.5.0 Patch available GHSA-hmqr-wjmj-376c

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:*before 1.5.0Vulnerablegravitl
  • cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:* Versions before 1.5.0 Vulnerable ·gravitl

Remediation

  • Fix · CNA netmaker (gravitl) Fixed in 1.5.0
  • Fix · GHSA-hmqr-wjmj-376c github.com/gravitl/netmaker (Go) Fixed in 1.5.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-29194
  2. 2026-10-03 Alias added: GHSA-hmqr-wjmj-376c
  3. 2026-10-25 Priority changed: MEDIUM → LOW
  4. 2026-11-04 Priority changed: LOW → MEDIUM

References

Advisory 2

Other 2

  • TI-2026-23313 Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys CVSS 4.0HIGH 8.7
  • TI-2026-23312 Netmaker: Privilege Escalation from Admin to Super-Admin via User Update CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences