CVE-2026-29196CWE-863

Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys

High · published March 7, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
21.0
In the wild
Unconfirmed
What it is

Netmaker makes networks with WireGuard. Prior to version 1.5.0, a user assigned the platform-user role can retrieve WireGuard private keys of all wireguard configs in a network by calling GET /api/extclients/{network} or GET /api/nodes/{network}. While the Netmaker UI restricts visibility, the API endpoints return full records, including private keys, without filtering based on the requesting user's ownership. This issue has been patched in version 1.5.0.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00295 · 21.0th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-03-07T16:15Z
EPSS history
Timeline
  • 07 MAR 16:15Z
    Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys
    cvelistv5