# CVE-2026-81034: Netmaker disabled TLS certificate verification in SMTP client

Source: https://junglewise.ai/threats/cve-2026-81034-netmaker-disabled-tls-certificate-verification-in-smtp-client  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-81034 · Severity: medium · CVSS 6.5 · Published 2026-08-26

Netmaker is a network management platform that uses email to send password-reset tokens and user invitations. The software unconditionally disables TLS certificate verification when connecting to mail servers, allowing an attacker on the network path to intercept these emails and use captured reset tokens to take over user accounts before the legitimate recipient.

## Quick answers

**Is CVE-2026-81034 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81034 being exploited in the wild.

**How severe is CVE-2026-81034?** Medium severity, with a CVSS score of 6.5, published 26 August 2026.

**Which products and versions are affected?** Gravitl Netmaker 1.6.0 and prior released versions.

**Is there a fix for CVE-2026-81034?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-81034 attacked?** It is attacked over the network or from the adjacent network, in a hosted service.

**Am I affected by CVE-2026-81034?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an insecure TLS configuration in the SMTP client code (pro/email/smtp.go). The TLS configuration object instantiates with InsecureSkipVerify set unconditionally to true, disabling certificate validation. This allows a network-positioned attacker (MITM) to intercept SMTP connections without triggering certificate errors. The vulnerable code includes a comment acknowledging that verification should be enabled in production, but no configuration option or code path overrides the hardcoded setting. Sensitive emails containing password-reset tokens and user enrollment links are transmitted in plaintext over these unverified connections, enabling account takeover. The issue is reportedly fixed in the development branch but persists in released versions.

## Affected products

- Gravitl Netmaker 1.6.0 and prior released versions

## Timeline

- 2026-08-26: disclosed

## References

- [https://github.com/gravitl/netmaker](https://github.com/gravitl/netmaker)
- [https://github.com/gravitl/netmaker/blob/v1.6.0/pro/email/smtp.go](https://github.com/gravitl/netmaker/blob/v1.6.0/pro/email/smtp.go)