CVE-2026-29196: Netmaker Vulnerability Allows Unauthorized Access to WireGuard Private Keys
Summary
CVE-2026-29196: Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys. Affects github.com/gravitl/netmaker versions < 1.5.0. Fixed in 1.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Netmaker is an open-source networking tool that simplifies the management of WireGuard networks. It provides a user-friendly interface for creating and managing secure connections between devices. However, a critical vulnerability has been identified that allows users with the platform-user role to access sensitive configuration files, including WireGuard private keys, through specific API endpoints.
Vulnerability Detail
The vulnerability arises from insufficient access control in the Netmaker API. Users assigned the platform-user role can retrieve WireGuard private keys of all configurations within a network by calling the GET /api/extclients/{network} or GET /api/nodes/{network} endpoints. Although the Netmaker UI restricts visibility to certain users, the API does not enforce similar restrictions, leading to potential unauthorized access to sensitive data. This could result in compromised network security, as attackers could exploit these private keys to gain unauthorized access to the network.
How To Fix
Latest published version: v1.7.0 as of 23 Oct 2026
go get github.com/gravitl/netmaker@v1.7.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.0
This is the first release that contains the fix.
go get github.com/gravitl/netmaker@v1.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the API endpoints by implementing additional authentication checks or by limiting the roles that can access sensitive information until the package is updated.
Conclusion
CVE-2026-29196 is a significant vulnerability in the Netmaker package that can lead to unauthorized access to sensitive WireGuard private keys. Users are strongly advised to update to version 1.5.0 or later to mitigate this risk. Implementing temporary workarounds can help protect your network until the update is applied.
See every vulnerability recorded for github.com/gravitl/netmaker →
FAQ
CVE-2026-29196 is a vulnerability in the Netmaker package that allows unauthorized users to access WireGuard private keys through insecure API endpoints.
If exploited, this vulnerability can lead to unauthorized access to your network, potentially allowing attackers to intercept or manipulate network traffic.
Implement access controls on the API endpoints as a temporary measure to limit exposure until you can update to the patched version.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 8.7, indicating a high level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/gravitl/netmaker.
