Netmaker CVE-2026-115325

Requires an authenticated Netmaker account (through v1.7.0) holding external-client permissions on at least one network (PR:L); no user interaction and no special product configuration are needed - the updateExtClient handler's unscoped client lookup is present in default deployments. The attacker then targets a client belonging to a network they are NOT scoped to via PUT /api/extclients/{network}/{clientid}. Limiting factors: exploitation is gated by possessing valid credentials with external-client management rights (so not fully unauthenticated), and affected deployments are those running Netmaker 1.7.0 or earlier before the PR #4153 fix; the only complete remediation is updating to the patched version.

The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L) describes a network-reachable, low-complexity flaw requiring only low privileges (PR:L) and no user interaction, with high confidentiality and integrity impact - consistent with an authorization bypass (CWE-639) that leaks WireGuard private keys and lets clients be tampered with or disabled. Not all signals point to maximum urgency, however: no CISA KEV listing is present in the input, no EPSS probability was supplied, and no confirmed working exploit code is referenced, so there is no evidence of active or widespread exploitation. The vuln.today decision label is 'this_week' (not act_now/emergency), which aligns with a serious-but-not-crisis posture. The key limiting factor is that PR:L means the attacker must already hold a valid Netmaker account with external-client permissions on at least one network, so this is a privilege-escalation/lateral-movement issue for an authenticated insider or an attacker who has compromised one scoped account - not a fully unauthenticated internet-wide exploit. Note that the fix is public as a reviewable one-line diff (unscoped GetExtClientByName replaced with network-scoped GetExtClient), which materially lowers the effort to reverse-engineer a working exploit even though none is confirmed yet. EPSS is absent, so probability-of-exploitation cannot be weighed quantitatively.

An attacker holds a legitimate Netmaker account with external-client permissions scoped to one network (e.g., a tenant or team they administer). They send a PUT request to /api/extclients/{network}/{clientid} naming a different network's client; because the handler looked the client up without validating the network scope, the request succeeds. They retrieve the victim client's WireGuard private key (enabling impersonation/VPN traffic interception) or disable/replace keys to break connectivity. No confirmed working exploit code is referenced, but the vendor fix is publicly visible as a small diff.