CVE-2026-38651

描述

Netmaker by Gravitl is an open-source WireGuard-based networking platform for creating and managing virtual overlay networks. The `VerifyHostToken` function in `logic/jwts.go` does not validate the JWT signature when verifying host tokens. After calling `jwt.ParseWithClaims`, the function only checks whether the returned token object is non-nil. It does not check `token.Valid` or the returned error. An attacker can forge a JWT signed with any key, set the claims to any host ID, and pull that host's full configuration including bcrypt-hashed passwords, MQTT credentials, and WireGuard peer data. The issue was patched in v1.5.0.

如何修補 CVE-2026-38651

要修補 CVE-2026-38651,請將受影響套件升級到下列已修補版本。

• —升級至 1.5.0 或更新版本

CVE-2026-38651 正在被利用嗎?

低 — EPSS 為 0.1%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 1.5.0

CVSS 分數

參考連結(4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-38651
• PATCHgithub.com/gravitl/netmaker
• WEBgithub.com/gravitl/netmaker/commit/5309aa70d464ef565911369714d661a61481a79b
• WEBwww.zyenra.com/advisories/netmaker-jwt-verification-bypass