SQL Injection in Netmaker Prior to Version 1.5.0

Executive Summary

CVE-2026-32599 is a boolean-based SQL injection vulnerability in Netmaker, affecting versions before 1.5.0. It occurs in the sqliteDeleteRecord function where user input is directly concatenated into SQL DELETE statements without sanitization. This allows authenticated attackers to manipulate queries by injecting SQL operators into the domain path parameter. The attack is boolean-based, enabling inference of database information like table names or values through query success or failure.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unusual SQL query patterns or errors in Netmaker logs, particularly around the sqliteDeleteRecord function. Check for boolean-based SQL injection attempts in the {domain} path parameter. Use tools like SQLMap to test for SQL injection vulnerabilities in authenticated endpoints.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to extract sensitive data from the database, such as credentials or network configurations. They might also modify or delete data, leading to service disruption or unauthorized access. Since the attack requires authentication, the attacker must first gain valid credentials or access to the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using affected Netmaker versions may face compliance violations, potential fines, and reputational damage due to insufficient data protection measures.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Netmaker to version 1.5.0 or later to patch the vulnerability. If upgrading is not immediately possible, restrict access to authenticated users only and monitor for suspicious activity. Consider disabling the SQLite backend temporarily if PostgreSQL is not an option.

Useful 0 Not Useful 0