Executive brief
Netmaker is a network management platform that uses email to send password-reset tokens and user invitations. The software unconditionally disables TLS certificate verification when connecting to mail servers, allowing an attacker on the network path to intercept these emails and use captured reset tokens to take over user accounts before the legitimate recipient.
Technical details
The vulnerability is an insecure TLS configuration in the SMTP client code (pro/email/smtp.go). The TLS configuration object instantiates with InsecureSkipVerify set unconditionally to true, disabling certificate validation. This allows a network-positioned attacker (MITM) to intercept SMTP connections without triggering certificate errors. The vulnerable code includes a comment acknowledging that verification should be enabled in production, but no configuration option or code path overrides the hardcoded setting. Sensitive emails containing password-reset tokens and user enrollment links are transmitted in plaintext over these unverified connections, enabling account takeover. The issue is reportedly fixed in the development branch but persists in released versions.
Affected products
- Gravitl Netmaker 1.6.0 and prior released versions
Timeline
- 2026-08-26: disclosed