CVE-2026-32599: Netmaker SQL Injection Vulnerability in SQLite Backend
Summary
CVE-2026-32599: Netmaker has a boolean‑based SQL Injection. Affects github.com/gravitl/netmaker versions < 1.5.0. Fixed in 1.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Netmaker is an open-source networking tool that facilitates the management of virtual private networks (VPNs) and other networking functionalities. It allows users to create and manage networks efficiently, providing features such as DNS management and network monitoring. However, a critical vulnerability has been identified in its SQLite database backend, which can lead to SQL injection attacks, particularly affecting authenticated users.
Vulnerability Detail
The vulnerability arises from the sqliteDeleteRecord function in Netmaker's database layer, which constructs SQL DELETE statements using direct string concatenation of user-supplied input. This practice allows an authenticated attacker to perform boolean-based SQL injection by manipulating the {domain} path parameter in the DELETE API endpoint. The attacker can infer sensitive information from the database by observing the outcomes of their injected conditions, potentially leading to unauthorized data extraction from arbitrary database tables.
How To Fix
Latest published version: v1.7.0 as of 23 Oct 2026
go get github.com/gravitl/netmaker@v1.7.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.0
This is the first release that contains the fix.
go get github.com/gravitl/netmaker@v1.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the SQLite backend and switch to the PostgreSQL backend, which employs parameterized queries and is not affected by this vulnerability.
Conclusion
The CVE-2026-32599 vulnerability in Netmaker's SQLite backend poses a significant risk of SQL injection attacks, allowing authenticated users to manipulate database queries. It is crucial for users to update to the patched version 1.5.0 or switch to a more secure database backend to safeguard their applications.
See every vulnerability recorded for github.com/gravitl/netmaker →
FAQ
CVE-2026-32599 is a vulnerability in the Netmaker application that allows authenticated users to perform SQL injection attacks through the SQLite database backend.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities without requiring any installation.
An attacker can exploit this vulnerability to extract sensitive information from the database, including table names, column names, and even data values.
Yes, a patch is available in version 1.5.0 of the Netmaker package, which addresses the SQL injection issue.
If immediate updating is not possible, consider switching to the PostgreSQL backend as a temporary workaround to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/gravitl/netmaker.
