Netmaker EUVD-2026-66610

Exploitation requires the attacker to be network-positioned on the path between the Netmaker server and its configured SMTP mail relay - this is the AT:P (attack requirement: presence) condition encoded in the CVSS 4.0 vector. The Netmaker Pro SMTP email feature must be configured and actively sending mail (i.e., a password-reset or invitation must be triggered during the interception window). No authentication to Netmaker is required by the attacker. What limits exploitation: the attacker cannot exploit this from an arbitrary remote position - they must control or compromise a network segment traversed by the SMTP connection; exploitation windows are narrow (single-use tokens expire); and only the Pro tier with SMTP configured is affected, not all Netmaker deployments. Installations where the SMTP relay is co-located on the same host or communicates only over localhost are not exploitable via this path.

The CVSS 4.0 score of 8.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N) captures the key tension: high confidentiality impact but an attack requirement (AT:P) of adversarial positioning on the network path between the Netmaker server and its mail relay. In practice, this means exploitation is non-trivial for a fully remote attacker but entirely feasible for a cloud-hosted adversary controlling an intermediate network segment, a rogue infrastructure provider, or an attacker already present on a shared hosting environment. The VI:L component reflects the ability to use a captured reset token, which constitutes real integrity impact against user accounts. No KEV listing and no public exploit code reduce near-term automated exploitation risk; however, because the token interception enables full account takeover for whichever user requests a reset, the per-exploitation impact is severe despite the positioning requirement. Even a mid-sized deployment operating on commodity cloud infrastructure where network paths are partially uncontrolled should treat this as an urgent remediation priority. EPSS data is not provided, so empirical exploitation probability cannot be stated numerically - risk should be assessed primarily from the structural nature of the flaw and the sensitivity of intercepted content rather than base-rate exploitation data.

An attacker with the ability to intercept traffic between the Netmaker server and its SMTP relay - for example, by ARP-spoofing on a shared cloud segment or controlling a compromised upstream router - presents a forged TLS certificate during the SMTP handshake. Netmaker accepts it without verification, and the attacker reads the plaintext email stream. When a legitimate user triggers a password-reset, the attacker captures the single-use token from the intercepted message and submits it to the Netmaker reset endpoint before the user opens their inbox, gaining full control of the targeted account.