Live › vulnerability › CVE-2026-115325
Go to dashboardNetmaker up to and including 1.7.0: updateExtClient uses an unscoped lookup (GetExtClientByName), so a user with external-client permission on one network can PUT /api/extclients/{other-network}/{clientid} to replace public keys, disable clients and read WireGuard private keys. CVSS 8.7 (v4) / 8.3 (v3.1). Needs a valid account with ext-client rights. Fixed on master by PR #4153; no tagged release with the fix found yet.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| netmaker | github | <= 1.7.0 | – |
netmaker --version or check the server image tag; 1.7.0 or earlier is affectedv1.7.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks. Attackers with external client permissions on one network can send PUT requests to /api/extclients/{network}/{clientid} to replace public keys, disable clients, and obtain WireGuard private keys.
This page as .md · .json · in your agent: get_signal("CVE-2026-115325")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.