CVE-2026-38651 Details
Description
Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validate the JWT signature when verifying host tokens. An attacker can forge a JWT signed with any arbitrary key and use it to impersonate any host in the network, gaining access to sensitive information
A vulnerability allowing authentication bypass has been identified in Netmaker versions prior to 1.5.0. The issue arises in the VerifyHostToken function within logic/jwts.go, where the JWT signature is not properly validated when verifying host tokens. This oversight allows an attacker to forge a JWT, sign it with any key, and use it to impersonate a host on the network. Exploitation of this vulnerability grants access to sensitive information, including the host's full configuration, bcrypt-hashed passwords, MQTT credentials, and WireGuard peer data.
Upgrade to Netmaker v1.5.0 or later. After upgrading, rotate all MQTT credentials, host passwords, and the server's TrafficKey to invalidate any credentials that may have been obtained through exploitation. Audit access logs for unusual 'GET /api/v1/host' requests from unexpected sources.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.zyenra.com/advisories/netmaker-jwt-verification-bypass/ | CISA-ADP | ExploitThird Party Advisory |
| https://www.zyenra.com/blog/netmaker-jwt-verification-bypass | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/gravitl/netmaker/commit/5309aa70d464ef565911369714d661a61481a79b | [email protected] | Patch |
| https://www.zyenra.com/advisories/netmaker-jwt-verification-bypass | [email protected] | ExploitThird Party Advisory |
| https://www.zyenra.com/blog/netmaker-jwt-verification-bypass | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| netmaker netmaker | < 1.5.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | Initial Analysis | [email protected] |
| Apr 28, 2026 | CVE Modified | CISA-ADP |
| Apr 28, 2026 | New CVE Received | [email protected] |