CVE-2026-29196: Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys

March 9, 2026 (updated March 11, 2026)

A user assigned the platform-user role can retrieve WireGuard private keys of all wireguard configs in a network by calling GET /api/extclients/{network} or GET /api/nodes/{network}. While the Netmaker UI restricts visibility, the API endpoints return full records, including private keys, without filtering based on the requesting user’s ownership.

Credits Artem Danilov (Positive Technologies)

References

github.com/advisories/GHSA-4hgg-c4rr-6h7f
github.com/gravitl/netmaker
github.com/gravitl/netmaker/releases/tag/v1.5.0
github.com/gravitl/netmaker/security/advisories/GHSA-4hgg-c4rr-6h7f
nvd.nist.gov/vuln/detail/CVE-2026-29196

Code Behaviors & Features

Detect and mitigate CVE-2026-29196 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →