CVE-2026-38651: High severity Netmaker netmaker vulnerability
Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validate the JWT signature when verifying host tokens. An attacker can forge a JWT signed with any arbitrary key and use it to impersonate any host in the network, gaining access to sensitive information
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-38651?
CVE-2026-38651 has a high severity rating of 8.2 according to the CVSS 3.1 metrics.
What is CVE-2026-38651?
CVE-2026-38651 is an authentication bypass vulnerability in Netmaker versions prior to 1.5.0 that allows attackers to impersonate any host with a forged JWT.
How do I fix CVE-2026-38651?
To fix CVE-2026-38651, update Netmaker to version 1.5.0 or later, as a patch is available.
What can attackers do with CVE-2026-38651?
Attackers can exploit CVE-2026-38651 to forge a JWT and impersonate any host in the network, potentially compromising the entire system.
Which versions of Netmaker are affected by CVE-2026-38651?
CVE-2026-38651 affects all versions of Netmaker prior to 1.5.0.