Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-29196 is a vulnerability in Netmaker versions prior to 1.5.0 that allows a user with the platform-user role to retrieve WireGuard private keys for all WireGuard configurations within a network.'}, {'type': 'paragraph', 'content': "This happens because the API endpoints GET /api/extclients/{network} and GET /api/nodes/{network} return full records including private keys without properly filtering based on the requesting user's ownership or permissions."}, {'type': 'paragraph', 'content': 'The root cause is an incorrect authorization check (CWE-863), where the system performs authorization but fails to enforce it properly, allowing unauthorized access to sensitive private keys.'}, {'type': 'paragraph', 'content': 'The Netmaker UI restricts key visibility, but the API endpoints do not, leading to this exposure.'}, {'type': 'paragraph', 'content': 'This issue has been fixed in Netmaker version 1.5.0.'}] [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have a severe impact because it exposes WireGuard private keys to users who should not have access to them.

With access to private keys, an attacker or unauthorized user could potentially decrypt network traffic, impersonate network nodes, or gain unauthorized access to the network.

Such exposure compromises the confidentiality and integrity of the network communications secured by WireGuard.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by attempting to access the API endpoints that expose WireGuard private keys without proper authorization.'}, {'type': 'list_item', 'content': 'Use an HTTP client or command-line tool like curl to call the endpoints GET /api/extclients/{network} or GET /api/nodes/{network} on your Netmaker server.'}, {'type': 'list_item', 'content': 'For example, run: curl -X GET https://<netmaker-server>/api/extclients/<network> or curl -X GET https://<netmaker-server>/api/nodes/<network>'}, {'type': 'list_item', 'content': "If the response contains WireGuard private keys for all configurations in the network regardless of the requesting user's ownership or permissions, the vulnerability is present."}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Netmaker to version 1.5.0 or later, where this vulnerability has been patched.

Until the upgrade can be performed, restrict platform-user role access to trusted users only, as this role can exploit the vulnerability to retrieve private keys.

Additionally, monitor and audit API access to the endpoints GET /api/extclients/{network} and GET /api/nodes/{network} to detect any unauthorized attempts.

Useful 0 Not Useful 0