Auth bypass in Gravitl Netmaker
CVE-2026-29194
Netmaker makes networks with WireGuard. Prior to version 1.5.0, the Authorize middleware in Netmaker incorrectly validates host JWT tokens. When a route permits host authentication (hostAllowed=true), a valid host token bypasses all subsequent authorization checks without verifying that the host is authorized to access the specific requested resource. Any entity possessing knowledge of object identifiers (node IDs, host IDs) can craft a request with an arbitrary valid host token to access, modify, or delete resources belonging to other hosts. Affected endpoints include node info retrieval, host deletion, MQTT signal transmission, fallback host updates, and failover operations. This issue has been patched in version 1.5.0.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.005 (36.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 37th percentile — 36.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.005 · change: +0.001
Affected products
- Gravitl Netmaker — versions < 1.5.0
Weakness classification (CWE)
References
- github.com/gravitl/netmaker/security/advisories/GHSA-hmqr-wjmj-376c (Vendor Advisory)
- github.com/gravitl/netmaker/releases/tag/v1.5.0 (Product, Release Notes)
Frequently asked questions
- What is CVE-2026-29194?
- CVE-2026-29194 is a high-severity vulnerability in Gravitl Netmaker, classified under Incorrect Authorization. CVSS score: 8.1/10. Published 2026-03-07.
- How severe is CVE-2026-29194?
- High severity. CVSS v3 base score is 8.1 out of 10.