{"id":"CVE-2026-115325","kind":"vulnerability","aliases":["CVE-2026-115325"],"related":[],"title":"Netmaker: network users can take over WireGuard clients on other networks","description":"Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks. Attackers with external client permissions on one network can send PUT requests to /api/extclients/{network}/{clientid} to replace public keys, disable clients, and obtain WireGuard private keys.","summary":"Netmaker up to and including 1.7.0: updateExtClient uses an unscoped lookup (GetExtClientByName), so a user with external-client permission on one network can PUT /api/extclients/{other-network}/{clientid} to replace public keys, disable clients and read WireGuard private keys. CVSS 8.7 (v4) / 8.3 (v3.1). Needs a valid account with ext-client rights. Fixed on master by PR #4153; no tagged release with the fix found yet.","severity":"high","cvss":8.7,"epss":0.00289,"exploited":false,"exploited_at":null,"products":[{"name":"netmaker","fixed":[],"affected":"<= 1.7.0","ecosystem":"github"}],"ecosystems":["github"],"tags":["authorization-bypass","netmaker","package","self-hosted","wireguard"],"not_affected_if":["auth-required","netmaker-not-used","single-network-deployment"],"how_to_check":"Run 'netmaker --version' or check the server image tag; 1.7.0 or earlier is affected. Check whether non-admin users hold external-client permissions on any network. Audit logs for PUT /api/extclients/{network}/{clientid} where the user is not scoped to that network.","fix":"No patched release named yet. Build from master at or after commit 332d8b9bab030ee65e78b9141259e4e0e80ac4b0, or wait for the first release after v1.7.0. Until then, limit external-client permissions to trusted users. If abuse is suspected, rotate the keys of external clients.","status":"open","published_at":"2026-10-22T11:17:51+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-23T22:35:17+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:35:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Netmaker: network users can take over WireGuard clients on other networks","impact":"high","summary":"Netmaker through 1.7.0 lets a user with external-client permission on one network modify external clients on other networks via PUT /api/extclients/{network}/{clientid}. An attacker can replace public keys, disable clients, and obtain WireGuard private keys.","category":"package","who_cares":["netmaker","wireguard","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker reads WireGuard private keys and hijacks clients on other networks","analyst_note":"Find the fixed Netmaker version and the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-115325; the sources do not name a patched release.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["netmaker-not-used","single-network-deployment"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000477,"input_tokens":2933,"output_tokens":367,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed Netmaker version and the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-115325; the sources do not name a patched release.","search":"'-115325':14A,17A '-2026':13A,16A '/api/extclients':53B,135C '1.7.0':33B,99C '4153':88B '8.3':72B '8.7':70B 'account':77B 'allow':110C 'attack':122C 'author':20B,102C 'authorization-bypass':19B 'bypass':21B,103C 'client':8A,46B,63B,81B,118C,125C,143C 'clientid':57B,137C 'contain':100C 'cve':12A,15A 'cvss':69B 'disabl':62B,142C 'ext':80B 'ext-client':79B 'extern':45B,117C,124C 'external-cli':44B 'fix':83B,94B 'found':95B 'getextclientbynam':39B 'handler':108C 'host':26B 'includ':32B 'key':61B,68B,141C,148C 'lookup':38B 'master':85B 'modifi':116C 'need':74B 'netmak':1A,22B,28B,97C 'netmaker':18A 'network':2A,11A,50B,56B,112C,121C,129C,136C 'network-scop':111C 'obtain':145C 'one':49B,128C 'other-network':54B 'packag':23B 'permiss':47B,126C 'pr':87B 'privat':67B,147C 'public':60B,140C 'put':52B,132C 'read':65B 'releas':91B 'replac':59B,139C 'request':133C 'right':82B 'scope':113C 'self':25B 'self-host':24B 'send':131C 'tag':90B 'take':5A 'unscop':37B 'updateextcli':34B,107C 'use':35B 'user':3A,42B,114C 'v3.1':73B 'v4':71B 'valid':76B 'vulner':104C 'wireguard':7A,27B,66B,146C 'yet':96B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T11:17:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115325","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115325","severity":null,"published_at":"2026-10-22T11:17:51+00:00","modified_at":"2026-10-23T15:17:27+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115325:499","url":null,"severity":null,"published_at":"2026-10-23T23:41:47+00:00","modified_at":"2026-10-23T23:41:47+00:00","first_seen_at":"2026-10-23T23:41:47+00:00","fetched_at":"2026-10-23T23:41:47+00:00","note":"Fix is PR #4153 (commit 332d8b9, merged 2026-10-13, 2-line change scoping updateExtClient lookup by network). No release after v1.7.0 seen on GitHub releases page, so no patched version is named; checked 2026-10-23. No public PoC or exploitation found; social search not done."},{"source":"epss","external_id":"CVE-2026-115325","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115325","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":2116,"url":"https://www.vulncheck.com/advisories/netmaker-through-1.7.0-authorization-bypass-via-updateextclient-unscoped-lookup","title":"VulnCheck: Netmaker through 1.7.0 updateExtClient authorization bypass","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2117,"url":"https://github.com/gravitl/netmaker/issues/3875","title":"gravitl/netmaker #3875 cross-network ext client modification","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2118,"url":"https://github.com/gravitl/netmaker/pull/4153","title":"gravitl/netmaker PR #4153 fix (merged 2026-10-13, commit 332d8b9)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}