Authorization Bypass Vulnerability in Netmaker by Gravitl
CVE-2026-115325

8.7HIGH

Key Information:

Vendor

Gravitl

Status
Netmaker
Vendor
CVE Published:
22 October 2026

What is CVE-2026-115325?

Netmaker versions prior to 1.7.0 have a vulnerability in the updateExtClient handler that allows unauthorized users to manipulate external client settings across different networks. An attacker with external client permissions can exploit this flaw by sending PUT requests to the API endpoint /api/extclients/{network}/{clientid}. This could enable them to replace public keys, disable clients, or even retrieve WireGuard private keys, posing a significant risk to network security.

Affected Version(s)

netmaker 0 <= 1.7.0

References

https://github.com/gravitl/netmaker/issues/3875
issue-tracking
https://github.com/gravitl/netmaker/pull/4153
patchissue-tracking
https://github.com/gravitl/netmaker/commit/332d8b9bab030e...
patch

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lighthousekeeper1212 (Lighthouse Research Project)
leediay153 from Viettel Post
.