CVE-2026-29194: Gravitl Netmaker Auth Bypass Vulnerability

CVE-2026-29194 Overview

CVE-2026-29194 is an authorization bypass vulnerability affecting Gravitl Netmaker, an open-source platform for creating and managing WireGuard networks. The flaw exists in the Authorize middleware, which incorrectly validates host JWT tokens. When a route permits host authentication (hostAllowed=true), a valid host token bypasses all subsequent authorization checks without verifying that the host is authorized to access the specific requested resource.

This vulnerability allows any entity with knowledge of object identifiers (such as node IDs or host IDs) to craft requests with arbitrary valid host tokens to access, modify, or delete resources belonging to other hosts. Affected endpoints include node info retrieval, host deletion, MQTT signal transmission, fallback host updates, and failover operations.

Critical Impact

Unauthorized access to sensitive network infrastructure resources, enabling attackers to retrieve, modify, or delete nodes and hosts across the WireGuard network management platform.

Affected Products

• Gravitl Netmaker versions prior to 1.5.0

Discovery Timeline

• 2026-03-07 - CVE CVE-2026-29194 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-29194

Vulnerability Analysis

This authorization bypass vulnerability (CWE-863: Incorrect Authorization) stems from improper validation logic in the Netmaker authorization middleware. The vulnerability allows authenticated hosts to access resources they should not be authorized to interact with.

The flaw is particularly concerning because Netmaker manages WireGuard network configurations, meaning successful exploitation could allow an attacker to manipulate network topology, delete critical hosts, or intercept MQTT signaling used for network coordination. An attacker with low-privilege access and knowledge of target resource identifiers can escalate their access across the entire Netmaker deployment.

The attack is network-accessible and requires no user interaction, making it exploitable remotely by any authenticated host within the Netmaker environment.

Root Cause

The root cause is a logic error in the Authorize middleware. When processing requests to endpoints that allow host authentication (hostAllowed=true), the middleware correctly validates that the JWT token belongs to a legitimate host but fails to verify whether that specific host is authorized to access the requested resource.

This creates a horizontal privilege escalation scenario where any authenticated host can access or manipulate resources belonging to any other host by simply knowing the target resource's identifier.

Attack Vector

The attack vector is network-based and requires the attacker to possess:

1. A valid host JWT token (obtained through legitimate enrollment or compromise of any host)
2. Knowledge of target resource identifiers (node IDs, host IDs)

With these prerequisites, an attacker can craft HTTP requests targeting vulnerable endpoints. The middleware accepts the valid host token and grants access without performing resource-level authorization checks. Affected operations include retrieving node information, deleting hosts, sending MQTT signals, updating fallback hosts, and triggering failover operations.

The vulnerability affects multiple API endpoints that handle sensitive network management operations, potentially allowing an attacker to disrupt network connectivity, exfiltrate configuration data, or establish persistence within the WireGuard network infrastructure.

Detection Methods for CVE-2026-29194

Indicators of Compromise

• Unusual API requests to node or host management endpoints from hosts that do not own those resources
• Anomalous host deletion or modification events in Netmaker audit logs
• MQTT signal transmissions originating from unexpected hosts
• Unexpected failover operations or fallback host updates
• API access patterns showing a single host querying multiple unrelated node or host identifiers

Detection Strategies

• Monitor Netmaker API logs for requests where the authenticated host ID does not match the target resource's owner
• Implement anomaly detection for API calls to sensitive endpoints like host deletion or MQTT signaling
• Correlate host authentication events with subsequent resource access to identify cross-host access attempts
• Review access logs for enumeration patterns indicating reconnaissance of node and host identifiers

Monitoring Recommendations

• Enable verbose logging for all Netmaker API endpoints, particularly those handling host and node management
• Set up alerts for host deletion events and compare against authorized maintenance windows
• Monitor network traffic patterns for unusual WireGuard configuration changes
• Implement centralized log aggregation to correlate authentication and authorization events across the Netmaker deployment

How to Mitigate CVE-2026-29194

Immediate Actions Required

• Upgrade Netmaker to version 1.5.0 or later immediately
• Audit Netmaker logs for any suspicious cross-host resource access prior to patching
• Review all hosts enrolled in the Netmaker deployment and revoke any unauthorized or suspicious host tokens
• Implement network segmentation to limit API access to trusted management interfaces only

Patch Information

Gravitl has addressed this vulnerability in Netmaker version 1.5.0. The patch corrects the authorization middleware to properly validate that the authenticated host is authorized to access the specific requested resource, not just that the host token is valid.

For detailed information, see the GitHub Security Advisory GHSA-hmqr-wjmj-376c and the Netmaker v1.5.0 Release Notes.

Workarounds

• Restrict network access to Netmaker API endpoints using firewall rules or reverse proxy authentication
• Implement additional API gateway authorization controls to validate resource ownership before forwarding requests
• Monitor and alert on all host management API calls until patching is complete
• Consider temporarily disabling non-essential API endpoints that allow host authentication if operationally feasible

# Example: Restrict Netmaker API access to trusted management network
iptables -A INPUT -p tcp --dport 8081 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8081 -j DROP