CVE-2026-32599: Netmaker SQL Injection Vulnerability

CVE-2026-32599 Overview

CVE-2026-32599 is a SQL injection vulnerability in Netmaker, an open-source platform that builds WireGuard-based networks. The flaw resides in the sqliteDeleteRecord function within the database layer, which constructs SQL DELETE statements by directly concatenating user-supplied input. An authenticated attacker can exploit this to perform boolean-based SQL injection against the SQLite backend. The issue affects all versions prior to 1.5.0 and is tracked under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command). Netmaker version 1.5.0 remediates the vulnerability.

Critical Impact
Authenticated attackers can inject SQL fragments into DELETE operations and infer sensitive database contents through boolean-based blind SQL injection techniques.

Affected Products

Netmaker versions prior to 1.5.0
Netmaker deployments using the SQLite database backend
Self-hosted Netmaker servers exposing the API to authenticated users

Discovery Timeline

2026-09-15 - CVE-2026-32599 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-32599

Vulnerability Analysis

The vulnerability lives inside Netmaker's database abstraction layer, specifically in the sqliteDeleteRecord function. This function builds a SQL DELETE statement by concatenating user-controlled input directly into the query string. Because the input is not parameterized or sanitized, an authenticated attacker can inject additional SQL clauses that alter the intended query logic.

The attack pattern is boolean-based blind SQL injection. The attacker submits crafted payloads that make the DELETE operation succeed or fail based on the truth value of an injected condition. By observing responses across many requests, the attacker can enumerate database contents one bit at a time, including credentials, network configuration, and peer metadata.

Exploitation requires valid authentication to the Netmaker API, which limits the pool of potential attackers. However, compromised low-privilege accounts or malicious insiders can leverage the flaw to escalate their knowledge of the environment. Refer to the GitHub Security Advisory GHSA-r8cr-4f9w-7r75 for maintainer-published details.

Root Cause

The root cause is direct string concatenation of untrusted input into a SQL statement inside sqliteDeleteRecord. Parameterized queries or prepared statements were not used for the affected code path, violating standard database security practices for handling caller-supplied identifiers.

Attack Vector

The attack vector is network-based and requires authentication. An attacker with a valid Netmaker session invokes an API endpoint that ultimately routes to sqliteDeleteRecord with attacker-controlled parameters. Injected SQL fragments modify the WHERE clause of the DELETE statement, enabling blind data exfiltration through differential response behavior.

No verified public exploit code is available. See the Netmaker v1.5.0 Release notes for maintainer commentary on the fix.

Detection Methods for CVE-2026-32599

Indicators of Compromise

Unexpected DELETE statements in Netmaker SQLite logs containing SQL keywords such as OR, AND, SELECT, or UNION in identifier positions
Repeated authenticated API requests to delete-oriented endpoints with slowly varying payloads, indicative of blind SQL injection probing
Anomalous deletion or missing records in Netmaker network, node, or user tables without corresponding administrator activity

Detection Strategies

Enable verbose query logging on the Netmaker SQLite backend and alert on DELETE statements containing suspicious characters like single quotes, comment sequences, or boolean tautologies
Correlate authentication events with high-volume API requests from a single account to identify blind injection enumeration patterns
Deploy a web application firewall or reverse proxy in front of Netmaker with rules that inspect API request bodies for common SQL injection signatures

Monitoring Recommendations

Monitor Netmaker application logs for HTTP 4xx/5xx spikes associated with delete endpoints
Track authenticated user request rates and flag accounts that deviate from baseline API usage
Audit database schema state changes and unexpected row deletions against a known-good baseline

How to Mitigate CVE-2026-32599

Immediate Actions Required

Upgrade Netmaker to version 1.5.0 or later as the primary remediation
Rotate credentials, API tokens, and any secrets stored in the Netmaker database, since authenticated attackers may have exfiltrated data prior to patching
Review authentication logs and revoke access for any suspicious or unnecessary user accounts on Netmaker servers

Patch Information

The maintainers fixed the issue in Netmaker 1.5.0 by replacing string concatenation in sqliteDeleteRecord with safe query construction. Release details are published in the Netmaker v1.5.0 Release notes and the GitHub Security Advisory GHSA-r8cr-4f9w-7r75.

Workarounds

Restrict Netmaker API access to trusted management networks using firewall rules or a VPN gateway until patching is complete
Enforce the principle of least privilege for Netmaker user accounts and remove unused API tokens
Deploy a WAF policy that blocks SQL metacharacters in Netmaker API request parameters as a temporary compensating control

bash

# Upgrade Netmaker container to the patched version
docker pull gravitl/netmaker:v1.5.0
docker stop netmaker && docker rm netmaker
# Redeploy using your existing compose or run configuration pinned to v1.5.0