CVE-2026-29196

EPSS 0.01%

Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys

Published: 3/9/2026Modified: 3/23/2026

Also known as:GHSA-4hgg-c4rr-6h7fGO-2026-4651

Description

A user assigned the platform-user role can retrieve WireGuard private keys of all wireguard configs in a network by calling GET /api/extclients/{network} or GET /api/nodes/{network}. While the Netmaker UI restricts visibility, the API endpoints return full records, including private keys, without filtering based on the requesting user's ownership. > Credits > Artem Danilov (Positive Technologies)

Affected packages (2)

Go/github.com/gravitl/netmakerfrom 0, < 1.5.0
Go/github.com/gravitl/netmakerfrom 0, < 1.5.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References (4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-29196
PATCHhttps://github.com/gravitl/netmaker
WEBhttps://github.com/gravitl/netmaker/releases/tag/v1.5.0
WEBhttps://github.com/gravitl/netmaker/security/advisories/GHSA-4hgg-c4rr-6h7f