CVE-2026-81034
Received Received - Intake

Netmaker SMTP Server TLS Certificate Verification Disabled

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: VulnCheck

Description
Netmaker disables certificate verification on the connection to the configured mail server. The sender in pro/email/smtp.go assigns a TLS configuration whose skip-verify field is set to true unconditionally, directly beneath a comment stating that the setting should be false in production. No configuration value governs it and no code path restores verification, so the client accepts any certificate the mail server presents, including one an interposing party supplies. Mail that Netmaker sends over that connection includes password-reset messages carrying single-use tokens and user invitations carrying enrolment links, so a party positioned on the path between the server and its mail relay can read those messages in transit and use a captured reset token before the intended recipient does. The setting is absent from the development branch but present in the latest release.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-09-15
AI Q&A
2026-08-26
EPSS Evaluated
2026-09-14
NVD
CVE-2026-81034
EUVD
EUVD-2026-66610

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
netmaker netmaker *
gravitl netmaker to 1.6.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Netmaker disables certificate verification when connecting to its configured mail server. This means the system accepts any certificate presented by the mail server, including potentially fraudulent ones from attackers intercepting traffic. The vulnerability is hardcoded in the code and cannot be disabled via configuration.

Detection Guidance

Check Netmaker's SMTP configuration in pro/email/smtp.go for the unconditional setting of SkipVerify=true in TLS config. Inspect network traffic for unencrypted or improperly secured mail server connections.

Impact Analysis

An attacker on the network path between Netmaker and its mail server can read sensitive emails containing password-reset tokens or enrollment links. They could use these tokens to reset passwords or gain unauthorized access before the intended recipient.

Compliance Impact

This vulnerability likely violates data protection requirements in GDPR and HIPAA, as it allows unauthorized interception of sensitive personal data in transit. Organizations using Netmaker may face compliance violations and legal consequences.

Mitigation Strategies

Update Netmaker to the latest version where this issue is resolved. If not available, manually modify pro/email/smtp.go to remove SkipVerify=true and ensure proper certificate verification is enforced.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81034. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart