CVE-2026-29196: Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys
A user assigned the platform-user role can retrieve WireGuard private keys of all wireguard configs in a network by calling GET /api/extclients/{network} or GET /api/nodes/{network}. While the Netmaker UI restricts visibility, the API endpoints return full records, including private keys, without filtering based on the requesting user's ownership.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29196?
CVE-2026-29196 is classified as a critical severity vulnerability due to the exposure of sensitive WireGuard private keys.
How do I fix CVE-2026-29196?
To fix CVE-2026-29196, upgrade to Netmaker version 1.5.0 or later where the vulnerability is resolved.
Who is affected by CVE-2026-29196?
Any user with the platform-user role in Netmaker versions prior to 1.5.0 is affected by CVE-2026-29196.
What types of information can be accessed through CVE-2026-29196?
CVE-2026-29196 allows unauthorized access to WireGuard private keys associated with network configurations.
Is there a workaround for CVE-2026-29196 until a patch is applied?
There is no documented workaround for CVE-2026-29196; upgrading to the latest version is the recommended course of action.