Auth bypass in Gravitl Netmaker

CVE-2026-29194

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the Authorize middleware in Netmaker incorrectly validates host JWT tokens. When a route permits host authentication (hostAllowed=true), a valid host token bypasses all subseq…

Vulnerability class: Broken Access Control

EPSS: 0.000 (10.9th percentile) — read the EPSS interpretation.

Affected products

Gravitl Netmaker — versions < 1.5.0

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

https://github.com/gravitl/netmaker/security/advisories/GHSA-hmqr-wjmj-376c (x_refsource_CONFIRM)
https://github.com/gravitl/netmaker/releases/tag/v1.5.0 (x_refsource_MISC)