EUVD-2026-66610
GHSA-36r8-h3x6-x34c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector but AC:H because MITM positioning is required; C:H for token exposure; I:L for account takeover potential; no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Netmaker disables certificate verification on the connection to the configured mail server. The sender in pro/email/smtp.go assigns a TLS configuration whose skip-verify field is set to true unconditionally, directly beneath a comment stating that the setting should be false in production. No configuration value governs it and no code path restores verification, so the client accepts any certificate the mail server presents, including one an interposing party supplies. Mail that Netmaker sends over that connection includes password-reset messages carrying single-use tokens and user invitations carrying enrolment links, so a party positioned on the path between the server and its mail relay can read those messages in transit and use a captured reset token before the intended recipient does. The setting is absent from the development branch but present in the latest release.
AnalysisAI
Unconditional TLS certificate verification bypass in Netmaker's SMTP client (pro/email/smtp.go, v1.6.0) exposes sensitive email traffic to network-positioned adversaries. The hardcoded InsecureSkipVerify=true setting - present directly beneath a developer comment acknowledging it should be false in production - means Netmaker accepts any certificate its mail relay presents, including one supplied by an intercepting party. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be network-positioned on the path between the Netmaker server and its configured SMTP mail relay - this is the AT:P (attack requirement: presence) condition encoded in the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N) captures the key tension: high confidentiality impact but an attack requirement (AT:P) of adversarial positioning on the network path between the Netmaker server and its mail relay. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with the ability to intercept traffic between the Netmaker server and its SMTP relay - for example, by ARP-spoofing on a shared cloud segment or controlling a compromised upstream router - presents a forged TLS certificate during the SMTP handshake. Netmaker accepts it without verification, and the attacker reads the plaintext email stream. … |
| Remediation | The upstream development branch has removed the hardcoded InsecureSkipVerify=true setting, indicating a patch is in preparation; a released fixed version has not been independently confirmed at time of analysis - monitor https://github.com/gravitl/netmaker/releases and https://github.com/gravitl/netmaker/issues/4062 for a tagged release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit your mail relay configuration and network path to confirm whether SMTP traffic traverses any untrusted network segments; immediately implement network segmentation to isolate mail traffic to an internal relay only if operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Use of Hard-coded Cryptographic Key in Go github.com/gravitl/netmaker prior to 0.8.5,0.9.4,0.10.0,0.10.1. Rated critical
Netmaker makes networks with WireGuard. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low
Netmaker makes networks with WireGuard. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low
Denial of service in Gravitl Netmaker prior to 1.2.0 allows any remote unauthenticated attacker to terminate the server
Authentication bypass in Netmaker (Gravitl) versions prior to 1.5.0 lets remote unauthenticated attackers forge host JWT
Netmaker versions prior to 1.5.0 fail to properly validate host JWT tokens during authorization, allowing any attacker w
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Rated high severity (CVSS 7.2
Netmaker versions prior to 1.5.0 fail to properly validate role assignments in the user update API endpoint, allowing au
Netmaker versions prior to 1.5.0 expose WireGuard private keys through unauthenticated API endpoints when accessed by us
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today