Vulnerability Description
Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks. Attackers with external client permissions on one network can send PUT requests to /api/extclients/{network}/{clientid} to replace public keys, disable clients, and obtain WireGuard private keys.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/gravitl/netmaker
- https://github.com/gravitl/netmaker/blob/v1.7.0/controllers/ext_client.go#L879
- https://github.com/gravitl/netmaker/commit/332d8b9bab030ee65e78b9141259e4e0e80ac
- https://github.com/gravitl/netmaker/issues/3875
- https://github.com/gravitl/netmaker/pull/4153
- https://www.vulncheck.com/advisories/netmaker-through-1.7.0-authorization-bypass
FAQ
What is CVE-2026-115325?
CVE-2026-115325 is a vulnerability with a CVSS score of 8.3 (HIGH). Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks. Attackers with exter...
How severe is CVE-2026-115325?
CVE-2026-115325 has been rated HIGH with a CVSS base score of 8.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-115325?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.