Netmaker 1.7.0 Auth Bypass Lets Users Steal WireGuard Keys
A high-severity flaw in Netmaker allows network-scoped users to bypass authorization and extract private keys from external clients on other networks.
Key points
- CVE-2026-115325 allows unauthorized modification of external client configurations.
- Attackers can replace public keys and disable clients across network boundaries.
- The vulnerability exposes WireGuard private keys to network-scoped users.
Netmaker versions through 1.7.0 contain a high-severity authorization bypass in the updateExtClient handler. This flaw allows network-scoped users to modify external clients on networks they should not access. The vulnerability enables attackers to replace public keys, disable clients, and obtain WireGuard private keys.
Root cause
The NVD record describes the issue as an authorization bypass vulnerability in the updateExtClient handler. It is classified under weakness CWE-639. The description states that the flaw allows network-scoped users to modify external clients on other networks. The source material does not specify the underlying code logic or validation failure that leads to this bypass.
Attack path
An attacker with external client permissions on one network can exploit this flaw. They send PUT requests to the /api/extclients/{network}/{clientid} endpoint. This action allows them to target specific clients on different networks. The attacker can then replace the client's public keys or disable the client entirely. Crucially, this path also yields WireGuard private keys.
Affected versions
- Netmaker 1.7.0
- Netmaker versions prior to 1.7.0
- gravitl netmaker up to 1.7.0
Mitigation
- No fix has been confirmed yet.
- Restrict network access to the Netmaker API endpoints.
- Monitor for unauthorized PUT requests to the extclients path.
- Rotate WireGuard keys if exposure is suspected.
Detection notes
Security teams should monitor API logs for PUT requests to the extclients endpoint from unexpected sources. Look for modifications to external client configurations, such as public key changes or client disabling, initiated by users without broad network privileges. Check for access attempts from network-scoped users targeting resources outside their assigned network. Review authentication logs for lateral movement patterns between network segments. Alert on any extraction of private keys or sensitive configuration data.
What to do and how to stay safe: Netmaker
- Audit current Netmaker user permissions and network scopes.
- Implement network segmentation to limit API access.
- Monitor logs for unauthorized configuration changes.
- Prepare to rotate credentials once the vendor provides an update.
Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-115325?
The CVSS score is 8.7, which is rated as HIGH.
Which versions of Netmaker are affected?
Netmaker through version 1.7.0 is affected.
Can attackers steal private keys with this flaw?
Yes, attackers can obtain WireGuard private keys.
