CVE-2026-29194: Netmaker: Insufficient Authorization in Host Token Verification
Netmaker makes networks with WireGuard. Prior to version 1.5.0, the Authorize middleware in Netmaker incorrectly validates host JWT tokens. When a route permits host authentication (hostAllowed=true), a valid host token bypasses all subsequent authorization checks without verifying that the host is authorized to access the specific requested resource. Any entity possessing knowledge of object identifiers (node IDs, host IDs) can craft a request with an arbitrary valid host token to access, modify, or delete resources belonging to other hosts. Affected endpoints include node info retrieval, host deletion, MQTT signal transmission, fallback host updates, and failover operations. This issue has been patched in version 1.5.0.
Other sources
The Authorise middleware in Netmaker incorrectly validates host JWT tokens. When a route permits host authentication (hostAllowed=true), a valid host token bypasses all subsequent authorisation checks without verifying that the host is authorised to access the specific requested resource. Any entity possessing knowledge of object identifiers (node IDs, host IDs) can craft a request with an arbitrary valid host token to access, modify, or delete resources belonging to other hosts. Affected endpoints include node info retrieval, host deletion, MQTT signal transmission, fallback host updates, and failover operations.
Credits Artem Danilov (Positive Technologies)
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29194?
CVE-2026-29194 has been classified as a critical severity vulnerability due to insufficient authorization in host token verification.
How do I fix CVE-2026-29194?
To fix CVE-2026-29194, upgrade to Netmaker version 1.5.0 or later, which addresses the insufficient authorization issue.
What software is affected by CVE-2026-29194?
CVE-2026-29194 affects Netmaker versions prior to 1.5.0.
What is the impact of CVE-2026-29194?
The impact of CVE-2026-29194 is that attackers may bypass host authentication by exploiting the insufficient authorization of host JWT tokens.
Does CVE-2026-29194 affect my network security?
Yes, CVE-2026-29194 can significantly compromise network security by allowing unauthorized access through invalid tokens.