Netmaker 1.7.0 Vulnerable to High-Severity Auth Bypass in External Client Handler

Netmaker through version 1.7.0 contains CVE-2026-115325, a high-severity vulnerability in the updateExtClient handler. The flaw permits network-scoped users to bypass authorization controls and modify external client data across different network scopes.

What happened

The vulnerability, rated 8.7 on the CVSS scale, enables network-scoped users to bypass authorization controls within the Netmaker application. According to the National Vulnerability Database record, the issue exists in the updateExtClient handler component of the software. This specific handler is responsible for managing external client configurations within the Netmaker ecosystem.

Attackers who possess external client permissions on a single network can exploit this flaw. They achieve this by sending PUT requests to the API endpoint /api/extclients/{network}/{clientid}. This action allows them to target external clients that reside on other, separate networks. The breach of scope is the core mechanism that makes this vulnerability particularly dangerous for multi-tenant or multi-network deployments.

The successful exploitation of CVE-2026-115325 grants the attacker significant control over targeted external clients. They can replace the existing public keys associated with these clients, effectively breaking legitimate connectivity. Furthermore, attackers can disable the external clients entirely, causing a denial of service for those specific endpoints. Most critically, the vulnerability allows the extraction of WireGuard private keys from the affected clients.

Why it matters

The ability to obtain WireGuard private keys represents a severe compromise of cryptographic trust. Private keys are essential for establishing secure, encrypted tunnels between endpoints and the Netmaker infrastructure. If an attacker acquires these keys, they can impersonate legitimate clients or decrypt traffic, undermining the entire security posture of the network.

The scope of the vulnerability extends beyond the attacker's own network. Because network-scoped users can modify clients on other networks, a breach in one segment can cascade into others. This cross-network impact violates the principle of least privilege and isolation that such network management tools are designed to enforce.

The high CVSS score of 8.7 reflects the severity of the impact. The attack vector is remote, as it leverages existing API functionality in an unintended way. The vulnerability allows for the theft of private keys and the modification of public keys, which are critical components of network security.

What to watch

• Monitor Netmaker release notes for version updates that address CVE-2026-115325.
• Audit API logs for unusual PUT requests to the /api/extclients/ endpoint.
• Check for unexpected changes in public keys or disabled statuses for external clients.
• Verify the integrity of WireGuard private keys stored in your Netmaker configuration.

Who needs to act first

Teams should prioritize updating systems that expose the Netmaker API to untrusted or multi-tenant environments. Check whether any network-scoped users have access to external clients across different network boundaries. Roll out the patch to the most exposed instances first, ensuring that the update process does not disrupt active tunneling sessions. Back up current configuration files before applying changes to allow for rapid rollback if issues arise. Validate that the new version correctly enforces network scope isolation after the update is complete.

Background: APIs

APIs in healthcare allow different software systems to exchange patient data automatically. They streamline care coordination but introduce significant security risks if access controls are weak. You must enforce strict authentication, limit data exposure, and monitor traffic patterns to prevent unauthorized access or data leaks in these critical integrations.

Read the full guide: APIs in Healthcare: Secure Data Exchange Without Breaches

What to do and how to stay safe: Netmaker

• Apply the latest Netmaker update immediately to patch CVE-2026-115325.
• Rotate all WireGuard private keys for external clients that may have been exposed.
• Review API access logs for evidence of unauthorized PUT requests to client endpoints.
• Restrict network-scoped user permissions to the minimum required scope for their roles.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Netmaker are affected by this vulnerability?

Netmaker versions up to and including 1.7.0 are affected by CVE-2026-115325.

What is the CVSS score for this vulnerability?

The CVSS score is 8.7, which is rated as HIGH severity.

Can an attacker steal private keys using this flaw?

Yes, attackers can obtain WireGuard private keys by sending specific API requests to the updateExtClient handler.