Skip to content
Threat Feed
Subscribe
high advisory

Netmaker: Authorization bypass in updateExtClient handler (CVE-2026-115325)

Netmaker versions up to 1.7.0 contain an authorization bypass vulnerability allowing authenticated external clients to modify or exfiltrate configuration data from arbitrary networks via the updateExtClient handler.

CVE search metadata

CVE search record: CVE-2026-115325. Severity: high. CVSS: 8.3. KEV: no. Product: Netmaker (<= 1.7.0). Brief: Netmaker: Authorization bypass in updateExtClient handler (CVE-2026-115325). Brief link: https://feed.craftedsignal.io/briefs/2026-10-netmaker-auth-bypass/

Triage facts

Revision 1
Applicability
Netmaker (<= 1.7.0)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Oct 22, 14:16 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A1Likely

Netmaker versions through 1.7.0 are vulnerable to an authorization bypass in the updateExtClient handler. This vulnerability enables a user who already possesses external client permissions on a single network to perform unauthorized operations on other networks managed by the same Netmaker instance.

Impact

Successful exploitation allows an attacker to send crafted PUT requests to the /api/extclients/{network}/{clientid} endpoint. This permits the attacker to replace public keys, disable external clients, or exfiltrate sensitive WireGuard private keys from networks they should not have access to.

Recommendation

  • Upgrade Netmaker to a version beyond 1.7.0 immediately.
  • Audit logs for PUT requests to /api/extclients/ where the {network} identifier in the URI does not align with the authorized scope of the requesting user.
  • Review all external client configurations for unexpected public key changes or unauthorized state modifications.

Immediate actions

Patch Netmaker instances

IT Operations 48h

Threat Hunt

Identify PUT requests to /api/extclients/ in web access logs

T1190 high medium confidence hunt now

Data: Web server access logs

Mitigations

Upgrade Netmaker beyond 1.7.0

immediate IT Operations

CVE-2026-115325

Detection coverage 1

Detect CVE-2026-115325 Exploitation - Unauthorized API Request to updateExtClient

high

Detects potentially unauthorized PUT requests to the updateExtClient handler. This rule identifies API calls that might indicate an attempt to bypass authorization for external client management.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →