CVE-2026-29195: Privilege Escalation in Netmaker from Admin to Super-Admin
Summary
CVE-2026-29195: Netmaker has Privilege Escalation from Admin to Super-Admin via User Update. Affects github.com/gravitl/netmaker versions < 1.5.0. Fixed in 1.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Netmaker is an open-source networking tool that simplifies the management of virtual networks. It allows users to create and manage networks with ease, providing features such as user management, network configuration, and real-time monitoring. However, a critical vulnerability has been identified that allows an admin user to escalate their privileges to that of a super-admin, compromising the security of the application.
Vulnerability Detail
The vulnerability arises from the user update handler (PUT /api/users/{username}), which lacks proper validation checks. While the system correctly prevents an admin from assigning the admin role to another user, it fails to block the assignment of the super-admin role. This oversight allows an admin to elevate their privileges, potentially leading to unauthorized access and control over the entire application.
How To Fix
Latest published version: v1.7.0 as of 23 Oct 2026
go get github.com/gravitl/netmaker@v1.7.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.0
This is the first release that contains the fix.
go get github.com/gravitl/netmaker@v1.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that admin users are not granted the ability to update user roles until the package is updated. This can be done by restricting access to the user update endpoint or by implementing additional checks in your application logic.
Conclusion
In summary, CVE-2026-29195 is a privilege escalation vulnerability in the Netmaker package that allows admin users to gain super-admin privileges. It is crucial to update to version 1.5.0 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for github.com/gravitl/netmaker →
FAQ
The vulnerability allows an admin user to escalate their privileges to super-admin, which can lead to unauthorized access and control.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can allow an admin to gain full control over the application, potentially leading to data breaches and unauthorized actions.
Yes, the vulnerability has been patched in version 1.5.0 of the Netmaker package. It is recommended to update to this version.
The CVSS score of this vulnerability is 6.9, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/gravitl/netmaker.
