CVE-2026-115325 in Netmaker
Summary
by MITRE • 10/23/2026
Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks. Attackers with external client permissions on one network can send PUT requests to /api/extclients/{network}/{clientid} to replace public keys, disable clients, and obtain WireGuard private keys.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
Netmaker versions through 1.7.0 are affected by a critical authorization bypass vulnerability located within the updateExtClient handler of its API interface. This flaw stems from an insufficient check on user permissions relative to network scope during client modification operations. Specifically, the application fails to verify that the authenticated user possesses administrative or management privileges for the specific target network identified in the request path before allowing modifications to external clients associated with that network. Consequently, any user who holds valid credentials and has been granted access rights to manage external clients on one particular network can exploit this logic error to interact with resources belonging to entirely different networks within the same Netmaker instance.
The technical mechanism of exploitation involves sending authenticated PUT requests to the /api/extclients/{network}/{clientid} endpoint, where {network} is set to a target network for which the attacker does not hold appropriate permissions and {clientid} identifies an external client on that unauthorized network. By manipulating this request, attackers can overwrite critical configuration parameters of remote clients. This includes replacing public keys used in WireGuard configurations, effectively hijacking or disrupting established secure tunnels. Furthermore, the vulnerability allows adversaries to disable specific clients by altering their status flags, leading to denial-of-service conditions for legitimate users relying on those connections. Most critically, the flaw permits attackers to retrieve sensitive cryptographic material, specifically the private keys associated with the targeted external clients.
The operational impact of this vulnerability is severe due to the foundational role WireGuard plays in Netmaker’s architecture as a zero-trust network overlay solution. The ability to replace public keys allows an attacker to intercept and decrypt traffic intended for other users by substituting their own key pair, thereby facilitating man-in-the-middle attacks on encrypted communications. Disabling clients can disrupt critical infrastructure services or remote access pathways that depend on these specific endpoints. The exposure of WireGuard private keys is particularly damaging as it grants the attacker full control over the compromised client’s identity and communication channel. This level of compromise undermines the integrity, confidentiality, and availability guarantees provided by the zero-trust model, potentially allowing lateral movement across network segments that were intended to be isolated from each other based on user permissions.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management, as it involves an actor obtaining capabilities beyond their assigned role without proper authorization checks. It also relates to CWE-862 Missing Authorization, where the application fails to enforce access controls on specific resources. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior corresponds to T1078 Valid Accounts and potentially T1552 Unsecured Credentials if private keys are exfiltrated for later use in authentication bypasses or session hijacking scenarios. The vulnerability highlights the importance of rigorous scope validation in multi-tenant environments where network isolation is a primary security requirement.
Mitigation strategies should prioritize immediate upgrading to Netmaker version 1.7.1 or any subsequent release that addresses this authorization logic error. In instances where patching is not immediately feasible, administrators can implement compensating controls at the infrastructure level by restricting API access through reverse proxies or web application firewalls that enforce strict validation of network-scoped permissions before forwarding requests to the backend service. Additionally, rotating all WireGuard keys across affected networks is essential to invalidate any potentially compromised credentials obtained during exploitation. Regular audits of user roles and permission assignments should be conducted to ensure adherence to the principle of least privilege, minimizing the blast radius if a single account is compromised in the future.