CVE-2026-29771: Netmaker Vulnerable to Denial of Service via Server Shutdown Endpoint

March 4, 2026 (updated March 9, 2026)

The /api/server/shutdown endpoint allows termination of the Netmaker server process via syscall.SIGINT. This allows any user to repeatedly shut down the server, causing cyclic denial of service with approximately 3-second restart intervals.

References

github.com/advisories/GHSA-rhr9-hgcm-x289
github.com/gravitl/netmaker
github.com/gravitl/netmaker/security/advisories/GHSA-rhr9-hgcm-x289
nvd.nist.gov/vuln/detail/CVE-2026-29771

Code Behaviors & Features

Detect and mitigate CVE-2026-29771 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →