CVE-2026-81034: Netmaker through 1.6.0 Improper Certificate Validation in SMTP Client
Netmaker disables certificate verification on the connection to the configured mail server. The sender in pro/email/smtp.go assigns a TLS configuration whose skip-verify field is set to true unconditionally, directly beneath a comment stating that the setting should be false in production. No configuration value governs it and no code path restores verification, so the client accepts any certificate the mail server presents, including one an interposing party supplies. Mail that Netmaker sends over that connection includes password-reset messages carrying single-use tokens and user invitations carrying enrolment links, so a party positioned on the path between the server and its mail relay can read those messages in transit and use a captured reset token before the intended recipient does. The setting is absent from the development branch but present in the latest release.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set the SMTP client TLS configuration field skip-verify to false in production so certificate verification is performed (currently set to true unconditionally in pro/email/smtp.go under a comment stating it should be false in production).
Netmaker SMTP client (pro/email/smtp.go) TLSConfig.skip-verify = false
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Netmaker deployments that send email through the affected SMTP client are exposed when an attacker can position themselves on the network path between the Netmaker server and its configured mail relay. The issue affects password-reset and invitation emails sent over that connection.
What does an attacker need to exploit this?
The attacker does not need Netmaker credentials or user interaction, but must be able to intercept the SMTP connection and present a certificate. Because certificate verification is always disabled, the client accepts the attacker-supplied certificate.
What is the impact of intercepting the SMTP traffic?
An attacker can read password-reset messages containing single-use tokens and user invitations containing enrolment links. A captured password-reset token can be used before the intended recipient uses it.
Is there a configuration setting that enables certificate verification?
No. The affected sender sets certificate verification to be skipped unconditionally, with no configuration value controlling the behavior and no code path restoring verification.
What can be done if an update is not immediately available?
Limit exposure of the SMTP connection to trusted network paths and reduce the opportunity for an attacker to interpose between the Netmaker server and its mail relay. The provided data does not identify a product-level configuration workaround.