CVE-2026-38651: Netmaker Vulnerability in JWT Signature Verification

Background

Netmaker is an open-source networking platform developed by Gravitl, designed for creating and managing virtual overlay networks using WireGuard technology. It allows users to easily set up secure connections between devices over the internet. The platform's functionality includes managing host configurations, facilitating secure communications, and providing a user-friendly interface for network management. However, a critical vulnerability has been identified in its JWT (JSON Web Token) handling, which could expose sensitive information.

Vulnerability Detail

The vulnerability arises from the VerifyHostToken function in the logic/jwts.go file of the Netmaker package. This function fails to validate the JWT signature when verifying host tokens. Specifically, after calling jwt.ParseWithClaims, the function only checks if the returned token object is non-nil, neglecting to verify token.Valid or handle any returned errors. This oversight allows an attacker to forge a JWT signed with any key, manipulate the claims to impersonate any host ID, and gain unauthorized access to sensitive configurations, including bcrypt-hashed passwords, MQTT credentials, and WireGuard peer data. The implications of this vulnerability are severe, as it could lead to unauthorized access and potential data breaches.

go get github.com/gravitl/netmaker@v1.7.0

go get github.com/gravitl/netmaker@v1.5.0

Workaround

As a temporary workaround, you can implement additional checks in your application to validate JWT signatures before processing host tokens. However, this is not a substitute for updating to the patched version. Here is a basic example of how you might implement a signature check:

import (
    "github.com/dgrijalva/jwt-go"
    "log"
)

func VerifyToken(tokenString string, secretKey []byte) bool {
    token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
        // Ensure the token's signing method is what you expect
        if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
            return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
        }
        return secretKey, nil
    })

    if err != nil || !token.Valid {
        log.Println("Invalid token")
        return false
    }
    return true
}

This code snippet checks the token's validity and ensures the signing method is as expected.

Conclusion

In summary, the vulnerability identified as CVE-2026-38651 in the Netmaker package poses a significant risk due to improper JWT signature verification. It is crucial for users to update to version 1.5.0 or later to mitigate this risk. Additionally, implementing temporary workarounds can provide some level of protection until the update is applied.

See every vulnerability recorded for github.com/gravitl/netmaker →

FAQ