Netmaker
CVE-2026-29771
HIGH
GHSA-rhr9-hgcm-x289
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
8DescriptionGitHub Advisory
Netmaker makes networks with WireGuard. Prior to version 1.2.0, the /api/server/shutdown endpoint allows termination of the Netmaker server process via syscall.SIGINT. This allows any user to repeatedly shut down the server, causing cyclic denial of service with approximately 3-second restart intervals. This issue has been patched in version 1.2.0.
AnalysisAI
Denial of service in Gravitl Netmaker prior to 1.2.0 allows any remote unauthenticated attacker to terminate the server process by calling the unprotected /api/server/shutdown endpoint, which issues a SIGINT to the running process. Because the service restarts in roughly three seconds, attackers can loop the request to sustain a cyclic outage of the WireGuard-based overlay network. No public exploit identified at time of analysis and EPSS is low (0.04%), but the trivial nature of the request makes opportunistic abuse plausible once exposure is known.
Technical ContextAI
Netmaker is a Go-based control plane that builds and orchestrates WireGuard mesh networks, exposing a REST API for managing nodes, networks, and the server itself. The flaw is in an HTTP handler at /api/server/shutdown that calls syscall.SIGINT on its own process without enforcing authentication, authorization, or request-method scoping. This is a textbook CWE-404 (Improper Resource Shutdown or Release): a privileged lifecycle operation (process termination) is reachable by any client. The CPE cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:* indicates all versions of the Netmaker application below 1.2.0 are affected, and the Go module path go/github.com/gravitl/netmaker confirms the vulnerable component is the core server binary, not a peripheral plugin.
RemediationAI
Vendor-released patch: upgrade Netmaker to version 1.2.0 or later, per the GHSA-rhr9-hgcm-x289 advisory (https://github.com/gravitl/netmaker/security/advisories/GHSA-rhr9-hgcm-x289); SUSE users should apply SUSE-SU-2026:1042 from https://www.suse.com/support/update/SUSE-SU-2026:1042/. If immediate upgrade is not possible, restrict network access to the Netmaker API so only trusted management addresses can reach it (e.g., bind the API to a management interface or place it behind an authenticated reverse proxy/WAF), and explicitly block requests to /api/server/shutdown at the proxy layer - note that blocking admin endpoints at the proxy will also prevent legitimate remote shutdown operations and may interfere with orchestration tooling that relies on the API. Monitor the Netmaker process for repeated unexpected restarts as an indicator of attempted exploitation.
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Use of Hard-coded Cryptographic Key in Go github.com/gravitl/netmaker prior to 0.8.5,0.9.4,0.10.0,0.10.1. Rated critical
Netmaker makes networks with WireGuard. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low
Netmaker makes networks with WireGuard. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low
Unconditional TLS certificate verification bypass in Netmaker's SMTP client (pro/email/smtp.go, v1.6.0) exposes sensitiv
Authentication bypass in Netmaker (Gravitl) versions prior to 1.5.0 lets remote unauthenticated attackers forge host JWT
Netmaker versions prior to 1.5.0 fail to properly validate host JWT tokens during authorization, allowing any attacker w
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Rated high severity (CVSS 7.2
Netmaker versions prior to 1.5.0 fail to properly validate role assignments in the user update API endpoint, allowing au
Netmaker versions prior to 1.5.0 expose WireGuard private keys through unauthenticated API endpoints when accessed by us
Same weakness CWE-404 – Improper Resource Shutdown or Release
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today