Netmaker
CVE-2026-29771
HIGH
GHSA-rhr9-hgcm-x289
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Netmaker API
-
DeliverySend request to /api/server/shutdown
-
ExploitServer process receives SIGINT and terminates
-
ExecutionLoop request during ~3s restart window
-
ImpactSustained control-plane outage for WireGuard mesh
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2021 - Security Misconfiguration
ASVS 5.0
V15 - Secure Coding and Architecture Resource release
|
| Exploitation Conditions | The attacker needs network reachability to the Netmaker HTTP API (typically TCP port 8081 or whatever the operator exposes) and the ability to send a request to the /api/server/shutdown endpoint of a Netmaker instance running a version below 1.2.0. No authentication, no user interaction, no special configuration, and no privileges are required - the endpoint is exposed by default and accepts requests from any caller. The only limiting factors are network exposure of the API (instances bound to localhost or fronted by an authenticating proxy that filters this path are not reachable) and the deployed Netmaker version (1.2.0 and later remove the vulnerability). |
| Impact | Signals are mixed. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VA:H (high availability impact) yields 8.7 because exploitation is network-reachable, requires no authentication, no user interaction, and reliably destroys availability - exactly the worst case for a DoS bug. However EPSS is only 0.04% (13th percentile) and the CVE is not in CISA KEV, indicating no observed mass exploitation. There is no confidentiality or integrity impact (VC:N/VI:N), so the realistic worst case is sustained outage of the VPN/overlay control plane, which for production deployments is still meaningful because clients depend on Netmaker for peer configuration. Real-world risk is dominated by exposure: any Netmaker UI/API reachable on the public internet (a common deployment) is trivially DoS-able by an anonymous attacker, so prioritization should be driven by network exposure rather than EPSS. No conflicting signals between CVSS and description were observed. |
| Exploit ScenarioDerived | An attacker who discovers an internet-exposed Netmaker instance (e.g., via Shodan or asset scanning) sends a simple HTTP request to /api/server/shutdown, terminating the server. Scripting this request in a loop produces a sustained outage with roughly three-second restart cycles, disrupting WireGuard peer configuration and management across the entire mesh. No public exploit identified at time of analysis, but reproducing the issue from the description requires only curl. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – May 18, 2026
Denial of service in Gravitl Netmaker prior to 1.2.0 allows any remote unauthenticated attacker to terminate the server process by calling the unprotected /api/server/shutdown endpoint, which issues a SIGINT to the running process. Because the service restarts in roughly three seconds, attackers can loop the request to sustain a cyclic outage of the WireGuard-based overlay network. No public exploit identified at time of analysis and EPSS is low (0.04%), but the trivial nature of the request makes opportunistic abuse plausible once exposure is known.
Earlier versions of this analysis (1)
Netmaker makes networks with WireGuard. Prior to version 1.2.0, the /api/server/shutdown endpoint allows termination of the Netmaker server process via syscall.SIGINT. [CVSS 6.5 MEDIUM]
RemediationAI
Vendor-released patch: upgrade Netmaker to version 1.2.0 or later, per the GHSA-rhr9-hgcm-x289 advisory (https://github.com/gravitl/netmaker/security/advisories/GHSA-rhr9-hgcm-x289); SUSE users should apply SUSE-SU-2026:1042 from https://www.suse.com/support/update/SUSE-SU-2026:1042/. If immediate upgrade is not possible, restrict network access to the Netmaker API so only trusted management addresses can reach it (e.g., bind the API to a management interface or place it behind an authenticated reverse proxy/WAF), and explicitly block requests to /api/server/shutdown at the proxy layer - note that blocking admin endpoints at the proxy will also prevent legitimate remote shutdown operations and may interfere with orchestration tooling that relies on the API. Monitor the Netmaker process for repeated unexpected restarts as an indicator of attempted exploitation.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Netmaker is a Go-based control plane that builds and orchestrates WireGuard mesh networks, exposing a REST API for managing nodes, networks, and the server itself. The flaw is in an HTTP handler at /api/server/shutdown that calls syscall.SIGINT on its own process without enforcing authentication, authorization, or request-method scoping. This is a textbook CWE-404 (Improper Resource Shutdown or Release): a privileged lifecycle operation (process termination) is reachable by any client. The CPE cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:* indicates all versions of the Netmaker application below 1.2.0 are affected, and the Go module path go/github.com/gravitl/netmaker confirms the vulnerable component is the core server binary, not a peripheral plugin.
Know when Netmaker gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
Netmaker makes networks with WireGuard. Prior to version 1.2.0, the /api/server/shutdown endpoint allows termination of the Netmaker server process via syscall.SIGINT. This allows any user to repeatedly shut down the server, causing cyclic denial of service with approximately 3-second restart intervals. This issue has been patched in version 1.2.0.
Executive ViewAI
Gravitl Netmaker versions prior to 1.2.0 contain an unauthenticated remote denial-of-service vulnerability allowing attackers to repeatedly crash the WireGuard overlay network service, disrupting secure network access for all connected users. No public exploit identified at time of analysis; however, the trivial nature of the attack-a simple HTTP request to an unprotected endpoint-makes opportunistic exploitation likely once public awareness spreads. Organizations deploying Netmaker in production face immediate risk to network infrastructure availability.
Vendor-released patch: Gravitl Netmaker 1.2.0 or later
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)GitHub Advisory
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Use of Hard-coded Cryptographic Key in Go github.com/gravitl/netmaker prior to 0.8.5,0.9.4,0.10.0,0.10.1. Rated critical
Netmaker makes networks with WireGuard. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low
Netmaker makes networks with WireGuard. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low
Unconditional TLS certificate verification bypass in Netmaker's SMTP client (pro/email/smtp.go, v1.6.0) exposes sensitiv
Authentication bypass in Netmaker (Gravitl) versions prior to 1.5.0 lets remote unauthenticated attackers forge host JWT
Netmaker versions prior to 1.5.0 fail to properly validate host JWT tokens during authorization, allowing any attacker w
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Rated high severity (CVSS 7.2
Netmaker versions prior to 1.5.0 fail to properly validate role assignments in the user update API endpoint, allowing au
Netmaker versions prior to 1.5.0 expose WireGuard private keys through unauthenticated API endpoints when accessed by us
Exploit-DB