Netmaker makes networks with WireGuard. Prior to version 1.5.0, a user assigned the platform-user role can retrieve WireGuard private keys of all wireguard configs in a network by calling GET /api/extclients/{network} or GET /api/nodes/{network}. While the Netmaker UI restricts visibility, the API endpoints return full records, including private keys, without filtering based on the requesting user's ownership. This issue has been patched in version 1.5.0.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Gravitl |
|
No data.
No data.
References
History
Mon, 09 Mar 2026 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Gravitl
Gravitl netmaker |
|
| Vendors & Products |
Gravitl
Gravitl netmaker |
Sat, 07 Mar 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Netmaker makes networks with WireGuard. Prior to version 1.5.0, a user assigned the platform-user role can retrieve WireGuard private keys of all wireguard configs in a network by calling GET /api/extclients/{network} or GET /api/nodes/{network}. While the Netmaker UI restricts visibility, the API endpoints return full records, including private keys, without filtering based on the requesting user's ownership. This issue has been patched in version 1.5.0. | |
| Title | Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys | |
| Weaknesses | CWE-863 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2026-03-07T16:15:08.465Z
Updated: 2026-03-07T16:15:08.465Z
Reserved: 2026-03-04T14:44:00.715Z
Link: CVE-2026-29196
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-03-07T17:15:52.017
Modified: 2026-03-09T13:35:07.393
Link: CVE-2026-29196
Redhat
No data.