~ / search / GHSA-4hgg-c4rr-6h7f

GHSA-4hgg-c4rr-6h7f

Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys

Source: GitHub Advisory Database (reviewed) High CVE-2026-29196

Packages

EcosystemPackageAffectedFixed in
Go github.com/gravitl/netmaker < 1.5.0 1.5.0

Details

As written in the advisory (Markdown source, shown as plain text).

A user assigned the platform-user role can retrieve WireGuard private keys of all wireguard configs in a network by calling GET /api/extclients/{network} or GET /api/nodes/{network}. While the Netmaker UI restricts visibility, the API endpoints return full records, including private keys, without filtering based on the requesting user's ownership. > Credits > Artem Danilov (Positive Technologies)

References

External links from the advisory. They lead to third-party sites.