Auth bypass in Gravitl Netmaker

CVE-2026-29196

Netmaker makes networks with WireGuard. Prior to version 1.5.0, a user assigned the platform-user role can retrieve WireGuard private keys of all wireguard configs in a network by calling GET /api/extclients/{network} or GET /api/nodes/{ne…

Vulnerability class: Broken Access Control

EPSS: 0.000 (3.0th percentile) — read the EPSS interpretation.

Affected products

Gravitl Netmaker — versions < 1.5.0

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

https://github.com/gravitl/netmaker/security/advisories/GHSA-4hgg-c4rr-6h7f (x_refsource_CONFIRM)
https://github.com/gravitl/netmaker/releases/tag/v1.5.0 (x_refsource_MISC)