Netmaker CVE-2026-38651

Exploitation requires only network reachability to the Netmaker server's management API - no credentials, no user interaction, and no special configuration, since VerifyHostToken accepts any JWT regardless of signing key against default deployments. The primary limiting factor is network exposure: only Netmaker instances whose API is reachable by the attacker (e.g., internet-exposed or reachable from a compromised network segment) are exploitable, and the attacker must know or guess a valid host ID to impersonate a specific host, though host-scoped enumeration endpoints reduce that barrier. Affected deployments are those running any version prior to 1.5.0.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, base 8.2) describes a network-reachable, low-complexity, unauthenticated bypass with high confidentiality impact - consistent with the description of forging a JWT to impersonate any host. SSVC reinforces this: exploitation is 'poc', the attack is 'automatable: yes', and technical impact is 'partial'. The tension is between severity signals and exploitation-probability signals: EPSS is only 0.04% (12th percentile) and the CVE is not in CISA KEV, indicating that despite the low bar to exploit, no widespread or confirmed in-the-wild activity has been observed. This is best treated as a genuine high priority for anyone running Netmaker exposed to untrusted networks (trivial forgery, automatable, PoC published), while the low EPSS reflects the product's modest deployment footprint rather than difficulty of exploitation. Note the description emphasizes information disclosure (C:H, I:L), yet several host endpoints hardened by the patch are destructive (deleteHost, deleteNode) - integrity/availability impact could be higher in practice than the NVD I:L/A:N rating suggests; verify against vendor advisory.

An attacker who can reach the Netmaker server API crafts a JWT containing a target host's ID and signs it with an arbitrary key of their choosing, then sends it as a Bearer token to a host-scoped endpoint such as /api/v1/host/{hostid}/peer_info. Because the signature is never validated, the server accepts the forged token and returns sensitive peer and network topology data as though the request came from the legitimate host; a public proof-of-concept exists and the attack is automatable, so it can be scripted against many hosts.