CVE-2026-115325: Netmaker through 1.7.0 Authorization Bypass via updateExtClient Unscoped Lookup
Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks. Attackers with external client permissions on one network can send PUT requests to /api/extclients/{network}/{clientid} to replace public keys, disable clients, and obtain WireGuard private keys.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs permissions for external clients on at least one Netmaker network. They can then target external clients belonging to other networks through the affected API endpoint.
What access does exploitation provide?
The attacker can replace an external client's public key, disable the client, and obtain WireGuard private keys. This can compromise confidentiality and integrity of affected VPN client configurations.
How can I identify possible exposure or abuse?
Review PUT requests to /api/extclients/{network}/{clientid}, particularly requests made by users whose external-client permissions apply to a different network than the network named in the request. Check for unexpected public-key changes, disabled external clients, and WireGuard private-key retrievals.