Executive brief
Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys in github.com/gravitl/netmaker
Affected products
- Go github.com/gravitl/netmaker
Junglewise Threat Intelligence
CVE-2026-29196: GO-2026-4651 - Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys in github.com/gravitl/netmaker
CVE-2026-29196 · Severity: medium · CVSS 4 · Published 2026-03-11
Technologies: github.com/gravitl/netmaker (Go). Vendors: Go.
Related threats
- Netmaker makes networks with WireGuard. Prior to version 1.5.0, the `sqliteDeleteRecord` function in Netmaker's database layer constructs SQ
- Gravitl Netmaker authentication bypass in VerifyHostToken
- GO-2026-4654 - Netmaker has Privilege Escalation from Admin to Super-Admin via User Update in github.com/gravitl/netmaker
- GO-2026-4655 - Netmaker has Insufficient Authorization in Host Token Verification in github.com/gravitl/netmaker
- Gravitl Netmaker denial of service via server shutdown endpoint