Skip to content
OpenAdvisories

Product · gravitl

netmaker

12 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-32599

    Netmaker has a boolean‑based SQL Injection

    Netmaker makes networks with WireGuard. Prior to version 1.5.0, the `sqliteDeleteRecord` function in Netmaker's database layer constructs SQL `DELETE` statements using direct string concatenation of user-supplied input. This allows an authenticated attacker t…

    gravitl netmaker github.com/gravitl/netmaker Go
  • Medium 6.5
    CVE-2026-81034

    Netmaker through 1.6.0 Improper Certificate Validation in SMTP Client

    Netmaker disables certificate verification on the connection to the configured mail server. The sender in pro/email/smtp.go assigns a TLS configuration whose skip-verify field is set to true unconditionally, directly beneath a comment stating that the setting…

    gravitl netmaker
  • Medium 6.9
    CVE-2026-29195

    Netmaker: Privilege Escalation from Admin to Super-Admin via User Update

    Netmaker makes networks with WireGuard. Prior to version 1.5.0, the user update handler (PUT /api/users/{username}) lacks validation to prevent an admin-role user from assigning the super-admin role during account updates. While the code correctly blocks an a…

    gravitl netmaker github.com/gravitl/netmaker Go