Medium severity · published Mar 7, 2026
CVE-2026-29196
Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
Netmaker makes networks with WireGuard. Prior to version 1.5.0, a user assigned the platform-user role can retrieve WireGuard private keys of all wireguard configs in a network by calling GET /api/extclients/{network} or GET /api/nodes/{network}. While the Netmaker UI restricts visibility, the API endpoints return full records, including private keys, without filtering based on the requesting user's ownership. This issue has been patched in version 1.5.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
netmaker · gravitl
< 1.5.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-29196
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-29196
Product
https://github.com/gravitl/netmaker/releases/tag/v1.5.0
Vendor Advisory
https://github.com/gravitl/netmaker/security/advisories/GHSA-4hgg-c4rr-6h7f
More from netmaker
8.3
CVE-2026-115325
Netmaker through 1.7.0 Authorization Bypass via updateExtClient Unscoped Lookup
8.1
CVE-2026-29194
Netmaker: Insufficient Authorization in Host Token Verification
6.5
CVE-2026-81034
Netmaker through 1.6.0 Improper Certificate Validation in SMTP Client
6.5
CVE-2026-29195
Netmaker: Privilege Escalation from Admin to Super-Admin via User Update
6.5
CVE-2026-29771
Netmaker: Denial of Service via Server Shutdown Endpoint