Read the docs
TI-2026-28180 Aliases CVE-2026-38651GHSA-qpv2-rwc8-c993

Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0.

Priority HIGH 75CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-347.

Summary

Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validate the JWT signature when verifying host tokens. An attacker can forge a JWT signed with any arbitrary key and use it to impersonate any host in the network, gaining access to sensitive information

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00353 29th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix Fixed github.com/gravitl/netmaker (Go): 1.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—github.com/gravitl/netmaker (Go)before 1.5.01.5.0Patch availableGHSA-qpv2-rwc8-c993
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • github.com/gravitl/netmaker (Go) Vendor— Affected before 1.5.0 Fixed in 1.5.0 Patch available GHSA-qpv2-rwc8-c993

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:netmaker:netmaker:*:*:*:*:*:*:*:*before 1.5.0VulnerableNetmaker
  • cpe:2.3:a:netmaker:netmaker:*:*:*:*:*:*:*:* Versions before 1.5.0 Vulnerable ·Netmaker

Remediation

  • Fix · GHSA-qpv2-rwc8-c993 github.com/gravitl/netmaker (Go) Fixed in 1.5.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-38651
  2. 2026-10-03 Alias added: GHSA-qpv2-rwc8-c993

References

Exploit 3

Patch 1

Advisory 1

Other 1

  • TI-2022-00579 Use of Hard-coded Cryptographic Key in gravitl/netmaker CVSS 3.1CRITICAL 9.8
  • TI-2023-15381 Netmaker has Hardcoded DNS Secret Key CVSS 3.1HIGH 7.5
  • TI-2026-23357 Netmaker: Denial of Service via Server Shutdown Endpoint CVSS 4.0HIGH 8.7
  • TI-2022-07702 Use of Hard-coded Cryptographic Key in Netmaker CVSS 3.1HIGH 8.8
  • TI-2023-15383 Netmaker Privilige Escalation Vulnerability CVSS 3.1HIGH 8.8
  • TI-2022-16533 Netmaker vulnerable to Insufficient Granularity of Access Control CVSS 3.1HIGH 8.8
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences