CVE-2026-32599: SQL Injection Vulnerability in Netmaker Package
Summary
CVE-2026-32599: Netmaker has a boolean‑based SQL Injection in github.com/gravitl/netmaker. Affects github.com/gravitl/netmaker versions < 1.5.0. Fixed in 1.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Netmaker is an open-source networking tool that simplifies the creation and management of virtual networks. It allows users to connect devices across different environments seamlessly. However, like many software packages, it can be susceptible to vulnerabilities, particularly those related to SQL injection, which can compromise the integrity and security of the database it interacts with.
Vulnerability Detail
The vulnerability identified as CVE-2026-32599 is a boolean-based SQL injection found in the Netmaker package (github.com/gravitl/netmaker). This type of SQL injection occurs when an attacker can manipulate a SQL query by injecting boolean conditions, potentially allowing unauthorized access to sensitive data or the ability to modify the database. The vulnerability arises from improper handling of user input, which can lead to significant security risks, including data leakage and unauthorized data manipulation.
How To Fix
Latest published version: v1.7.0 as of 23 Oct 2026
go get github.com/gravitl/netmaker@v1.7.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.0
This is the first release that contains the fix.
go get github.com/gravitl/netmaker@v1.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation and sanitization to prevent malicious input from being processed. Ensure that all user inputs are properly escaped and validated before being used in SQL queries.
Conclusion
The CVE-2026-32599 vulnerability in the Netmaker package poses a significant risk due to its potential for SQL injection attacks. It is crucial for users to update to version 1.5.0 or later to protect their applications. Additionally, employing input validation can serve as a temporary workaround until the update can be applied.
See every vulnerability recorded for github.com/gravitl/netmaker →
FAQ
CVE-2026-32599 is a vulnerability in the Netmaker package that allows for boolean-based SQL injection, potentially compromising database security.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring installation.
The risks include unauthorized access to sensitive data, data manipulation, and potential complete compromise of the database.
Yes, the vulnerability has been patched in version 1.5.0 of the Netmaker package. Updating to this version will resolve the issue.
If you cannot update immediately, implement input validation and sanitization as a temporary measure to mitigate the risk of SQL injection.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/gravitl/netmaker.
