Security Digest · Vulnerability record
CVE-2026-38651: Netmaker does not verify JWT signatures for host tokens
Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0.
CVSS 9.2 Critical EPSS 0.4% · p37
Should you act?
Critical and remotely reachable
No known exploitation yet, but it is network-reachable without credentials. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.
- Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 0.4%, percentile 37: FIRST’s model estimates a 0.4% chance of exploitation activity in the next 30 days, higher than 37% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Only applies if your dependency tree includes
github.com/gravitl/netmaker(Go) < 1.5.0, fixed in 1.5.0. Check your lockfile, including transitive dependencies.
What it is
Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validate the JWT signature when verifying host tokens. An attacker can forge a JWT signed with any arbitrary key and use it to impersonate any host in the network, gaining access to sensitive information
From the GitHub advisory
Netmaker by Gravitl is an open-source WireGuard-based networking platform for creating and managing virtual overlay networks. The VerifyHostToken function in logic/jwts.go does not validate the JWT signature when verifying host tokens. After calling jwt.ParseWithClaims, the function only checks whether the returned token object is non-nil. It does not check token.Valid or the returned error. An attacker can forge a JWT signed with any key, set the claims to any host ID, and pull that host's full configuration including bcrypt-hashed passwords, MQTT credentials, and WireGuard peer data. The issue was patched in v1.5.0.
Weakness type: CWE-347.
Product: github.com/gravitl/netmaker (Go) · Assigned by: mitre · Published: 2026-04-28
Affected and fixed versions
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| Go | github.com/gravitl/netmaker | < 1.5.0 | 1.5.0 |
| Vendor | Product | Affected versions (per CVE record) |
|---|---|---|
| n/a | n/a | see vendor advisory |
Severity scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADP | 3.1 | 8.2 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
| GitHub | 4.0 | 9.2 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N |
- Attack vector: network (remotely reachable)
- Attack complexity: low
- Attack requirements: none
- Privileges required: none (no login)
- User interaction: none
CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.
Exploitation and urgency
- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc, automatable yes, technical impact partial.
- FIRST EPSS (model of 2026-10-21): 0.44% probability of exploitation activity in the next 30 days; percentile 37.
Timeline
- — CVE record last updated
- — CVE record published by mitre
- — GitHub-reviewed advisory GHSA-qpv2-rwc8-c993 published (critical)
Sources and references
Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.
Vulnerability records
- GitHub Advisory GHSA-qpv2-rwc8-c993 github.com
- CVE.org record CVE-2026-38651 cve.org
- NVD entry CVE-2026-38651 nvd.nist.gov
Other references from the CVE record and advisory
- github.com github.com
- zyenra.com zyenra.com
- zyenra.com zyenra.com