Netmaker (<= 1.7.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/netmaker--1.7.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 14:16:59 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgNetmaker: Authorization bypass in updateExtClient handler (CVE-2026-115325)https://feed.craftedsignal.io/briefs/2026-10-netmaker-auth-bypass/Thu, 22 Oct 2026 14:16:59 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-netmaker-auth-bypass/Netmaker versions up to 1.7.0 contain an authorization bypass vulnerability allowing authenticated external clients to modify or exfiltrate configuration data from arbitrary networks via the updateExtClient handler.Netmaker versions through 1.7.0 are vulnerable to an authorization bypass in the updateExtClient handler. This vulnerability enables a user who already possesses external client permissions on a single network to perform unauthorized operations on other networks managed by the same Netmaker instance.

Impact

Successful exploitation allows an attacker to send crafted PUT requests to the /api/extclients/{network}/{clientid} endpoint. This permits the attacker to replace public keys, disable external clients, or exfiltrate sensitive WireGuard private keys from networks they should not have access to.

Recommendation

  • Upgrade Netmaker to a version beyond 1.7.0 immediately.
  • Audit logs for PUT requests to /api/extclients/ where the {network} identifier in the URI does not align with the authorized scope of the requesting user.
  • Review all external client configurations for unexpected public key changes or unauthorized state modifications.
]]>highadvisory