CVE-2026-38651:

Authentication bypass vulnerability in Netmaker prior to version 1.5.0 allows unauthenticated attackers to forge JWT tokens and impersonate any network host due to missing signature validation in the VerifyHostToken function.

Score
A numerical rating that indicates how dangerous this vulnerability is.

8.2High

Published Date:Apr 28, 2026
CISA KEV Date:*No Data*
Industries Affected:20

Exploitability

Score:3.9
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:4.2
Confidentiality Impact:HIGH
Integrity Impact:LOW
Availability Impact:NONE

Description Preview

Overview

CVE-2026-38651 is an authentication bypass vulnerability in Netmaker, a WireGuard-based network management platform, affecting all versions prior to 1.5.0. The root cause is the failure of the `VerifyHostToken` function in `logic/jwts.go` to validate JWT cryptographic signatures when verifying host tokens. This flaw, classified as CWE-347 (Improper Verification of Cryptographic Signature), enables a remote, unauthenticated attacker to forge a JWT signed with any arbitrary key and impersonate any host in the network. The vulnerability carries a CVSS v3.1 score of 8.2 (HIGH), reflecting its network-based attack vector, low attack complexity, and significant confidentiality and integrity implications for affected deployments.

Remediation

Administrators should upgrade Netmaker to version 1.5.0 or later, which includes the fix introduced in commit `5309aa70d464ef565911369714d661a61481a79b` that corrects the JWT signature validation logic in the `VerifyHostToken` function. As an interim measure, network access to the Netmaker API should be restricted to trusted sources using firewall rules or network segmentation to reduce exposure. After upgrading, all existing host tokens should be rotated or invalidated as a precaution in case any unauthorized tokens were previously issued. Organizations should audit logs for anomalous host authentication activity that may indicate prior exploitation.