{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3anetmakernetmaker/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:netmaker:netmaker:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.3,"id":"CVE-2026-115325"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Netmaker (\u003c= 1.7.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Netmaker"],"content_html":"\u003cp\u003eNetmaker versions through 1.7.0 are vulnerable to an authorization bypass in the updateExtClient handler. This vulnerability enables a user who already possesses external client permissions on a single network to perform unauthorized operations on other networks managed by the same Netmaker instance.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to send crafted PUT requests to the /api/extclients/{network}/{clientid} endpoint. This permits the attacker to replace public keys, disable external clients, or exfiltrate sensitive WireGuard private keys from networks they should not have access to.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Netmaker to a version beyond 1.7.0 immediately.\u003c/li\u003e\n\u003cli\u003eAudit logs for PUT requests to /api/extclients/ where the {network} identifier in the URI does not align with the authorized scope of the requesting user.\u003c/li\u003e\n\u003cli\u003eReview all external client configurations for unexpected public key changes or unauthorized state modifications.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T14:16:59Z","date_published":"2026-10-22T14:16:59Z","id":"https://feed.craftedsignal.io/briefs/2026-10-netmaker-auth-bypass/","summary":"Netmaker versions up to 1.7.0 contain an authorization bypass vulnerability allowing authenticated external clients to modify or exfiltrate configuration data from arbitrary networks via the updateExtClient handler.","title":"Netmaker: Authorization bypass in updateExtClient handler (CVE-2026-115325)","url":"https://feed.craftedsignal.io/briefs/2026-10-netmaker-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:netmaker:netmaker:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}