CVE-2026-44343: WGDashboard Auth Bypass Vulnerability

CVE-2026-44343 Overview

CVE-2026-44343 is a critical vulnerability in WGDashboard, a web-based dashboard for managing WireGuard VPN deployments. Versions prior to 4.3.2 contain flaws that allow unauthorized parties to access the host file system without authentication. The root cause maps to [CWE-20] Improper Input Validation in the request path filtering logic that gates authenticated routes. An attacker with network reachability to the dashboard can interact with sensitive endpoints by crafting requests that bypass the whitelist check. The maintainers fixed the issue in WGDashboard 4.3.2.

Critical Impact
Remote, unauthenticated attackers can reach file-handling endpoints and read host file system contents on affected WGDashboard instances.

Affected Products

WGDashboard versions prior to 4.3.2
WGDashboard 4.3.1 (confirmed vulnerable build)
Self-hosted WireGuard deployments exposing the WGDashboard web interface

Discovery Timeline

2026-05-12 - CVE-2026-44343 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-44343

Vulnerability Analysis

The vulnerability resides in the request authorization middleware in src/dashboard.py. The pre-patch code maintained a whiteList of unauthenticated endpoints using bare substrings such as /fileDownload and /client. The check used filter(lambda x : x not in request.path, whiteList) to decide whether a request required an authenticated session. This pattern treats any request path containing a whitelisted substring as public, regardless of the actual route being targeted. An attacker can craft a URL that embeds a whitelisted token and reach protected handlers, including file-serving endpoints. Because WGDashboard runs with privileges sufficient to manage WireGuard configurations, exposed file routes can return arbitrary content from the host file system.

Root Cause

The root cause is improper input validation [CWE-20] in path-based authentication gating. The whitelist matched substrings rather than exact route prefixes, and the /fileDownload and /client entries lacked the application prefix or any structural boundary. Authentication was effectively skipped for any path containing these tokens.

Attack Vector

Exploitation requires only network access to the dashboard. No credentials, user interaction, or prior foothold are needed. An attacker sends an HTTP request to a file-handling endpoint with a path crafted to satisfy the substring whitelist, and the server returns file contents without enforcing the admin session check.

python

# Pre-patch vulnerable logic (src/dashboard.py)
whiteList = [
    '/static/', 'validateAuthentication', 'authenticate', 'getDashboardConfiguration',
    'getDashboardTheme', 'getDashboardVersion', 'sharePeer/get', 'isTotpEnabled', 'locale',
    '/fileDownload',
    '/client'
]

if (("username" not in session or session.get("role") != "admin")
        and (f"{(APP_PREFIX if len(APP_PREFIX) > 0 else '')}/" != request.path
        and f"{(APP_PREFIX if len(APP_PREFIX) > 0 else '')}" != request.path)
        and len(list(filter(lambda x : x not in request.path, whiteList))) == len(whiteList)

Source: GitHub Commit b15bbce

Detection Methods for CVE-2026-44343

Indicators of Compromise

Unauthenticated HTTP requests to paths containing fileDownload or /client returning HTTP 200 with file content
Access log entries for file-serving endpoints with no preceding authenticate or validateAuthentication call from the same client
Outbound responses from the WGDashboard process referencing sensitive host paths such as /etc, WireGuard key files, or wg-dashboard.ini

Detection Strategies

Inspect WGDashboard access logs for requests to file-related routes from clients that never established an authenticated session
Alert on bursts of requests against a single WGDashboard host containing whitelist tokens in unusual path positions
Monitor the WGDashboard process for reads of files outside its configuration directory, especially user home directories and system files

Monitoring Recommendations

Forward WGDashboard application logs and reverse proxy access logs to a centralized log platform for correlation
Baseline expected administrator source IPs and alert on file endpoint access from any other origin
Track the deployed WGDashboard version across hosts and flag any instance reporting v4.3.1 or earlier

How to Mitigate CVE-2026-44343

Immediate Actions Required

Upgrade WGDashboard to version 4.3.2 or later on every host running the dashboard
Restrict network exposure of the WGDashboard web interface to trusted management networks or a VPN bastion
Rotate WireGuard private keys and any secrets stored in wg-dashboard.ini if unauthenticated access cannot be ruled out
Audit access logs for requests to /fileDownload and /client routes prior to the upgrade

Patch Information

The fix is included in WGDashboard 4.3.2. The patch rewrites the whitelist to use full, prefix-anchored API routes such as f'{appPrefix}/api/authenticate' and replaces the substring in check with an exact endpoint match. The /fileDownload entry is removed from the unauthenticated whitelist, and /client access is gated through request.path.startswith(f'{appPrefix}/client'). See the GitHub Security Advisory GHSA-rrf5-q4fp-qvgm and the upstream commit for the complete change set.