CVE-2026-29196

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-29196", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-04T14:44:00.715Z", "datePublished": "2026-03-07T16:15:08.465Z", "dateUpdated": "2026-03-09T18:25:32.679Z"}, "containers": {"cna": {"title": "Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/gravitl/netmaker/security/advisories/GHSA-4hgg-c4rr-6h7f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gravitl/netmaker/security/advisories/GHSA-4hgg-c4rr-6h7f"}, {"name": "https://github.com/gravitl/netmaker/releases/tag/v1.5.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/gravitl/netmaker/releases/tag/v1.5.0"}], "affected": [{"vendor": "gravitl", "product": "netmaker", "versions": [{"version": "< 1.5.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-07T16:15:08.465Z"}, "descriptions": [{"lang": "en", "value": "Netmaker makes networks with WireGuard. Prior to version 1.5.0, a user assigned the platform-user role can retrieve WireGuard private keys of all wireguard configs in a network by calling GET /api/extclients/{network} or GET /api/nodes/{network}. While the Netmaker UI restricts visibility, the API endpoints return full records, including private keys, without filtering based on the requesting user's ownership. This issue has been patched in version 1.5.0."}], "source": {"advisory": "GHSA-4hgg-c4rr-6h7f", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-09T17:43:35.082495Z", "id": "CVE-2026-29196", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T18:25:32.679Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-29196", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-09T17:43:35.082495Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T17:43:36.180Z"}}], "cna": {"title": "Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys", "source": {"advisory": "GHSA-4hgg-c4rr-6h7f", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "gravitl", "product": "netmaker", "versions": [{"status": "affected", "version": "< 1.5.0"}]}], "references": [{"url": "https://github.com/gravitl/netmaker/security/advisories/GHSA-4hgg-c4rr-6h7f", "name": "https://github.com/gravitl/netmaker/security/advisories/GHSA-4hgg-c4rr-6h7f", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/gravitl/netmaker/releases/tag/v1.5.0", "name": "https://github.com/gravitl/netmaker/releases/tag/v1.5.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Netmaker makes networks with WireGuard. Prior to version 1.5.0, a user assigned the platform-user role can retrieve WireGuard private keys of all wireguard configs in a network by calling GET /api/extclients/{network} or GET /api/nodes/{network}. While the Netmaker UI restricts visibility, the API endpoints return full records, including private keys, without filtering based on the requesting user's ownership. This issue has been patched in version 1.5.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-07T16:15:08.465Z"}}}, "cveMetadata": {"cveId": "CVE-2026-29196", "state": "PUBLISHED", "dateUpdated": "2026-03-09T18:25:32.679Z", "dateReserved": "2026-03-04T14:44:00.715Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-07T16:15:08.465Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "netmaker", "vendor": "gravitl", "versions": [{"status": "affected", "version": "< 1.5.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:*", "matchCriteriaId": "2BC0009A-5594-47A8-AB15-257A6742197D", "versionEndExcluding": "1.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Netmaker makes networks with WireGuard. Prior to version 1.5.0, a user assigned the platform-user role can retrieve WireGuard private keys of all wireguard configs in a network by calling GET /api/extclients/{network} or GET /api/nodes/{network}. While the Netmaker UI restricts visibility, the API endpoints return full records, including private keys, without filtering based on the requesting user's ownership. This issue has been patched in version 1.5.0."}, {"lang": "es", "value": "Netmaker crea redes con WireGuard. Antes de la versi\u00f3n 1.5.0, un usuario asignado al rol de usuario 'platform-user' puede recuperar las claves privadas de WireGuard de todas las configuraciones de WireGuard en una red al llamar a GET /api/extclients/{network} o GET /api/nodes/{network}. Si bien la interfaz de usuario de Netmaker restringe la visibilidad, los endpoints de la API devuelven registros completos, incluyendo las claves privadas, sin filtrar bas\u00e1ndose en la propiedad del usuario solicitante. Este problema ha sido parcheado en la versi\u00f3n 1.5.0."}], "id": "CVE-2026-29196", "lastModified": "2026-06-17T10:29:45.663", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-29196", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T17:43:35.082495Z", "version": "2.0.3"}}]}, "published": "2026-03-07T17:15:52.017", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/gravitl/netmaker/releases/tag/v1.5.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/gravitl/netmaker/security/advisories/GHSA-4hgg-c4rr-6h7f"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.5.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "netmaker", "source": "cna", "vendor": "gravitl"}, "product": "netmaker", "vendor": "gravitl"}], "analysis": {"en": {"generated_at": "2026-04-18T09:46:10.847563+00:00", "value": {"mitigation_remediation": ["Upgrade Netmaker to version\u202f1.5.0 or later, which removes the API endpoint that exposes private keys.", "Restrict platform\u2011user permissions to only the networks necessary, limiting the scope of credentials that can call the vulnerable API endpoints.", "Audit and configure API access controls to enforce filtering of sensitive data, ensuring private keys are never returned in responses."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Access to Private Keys"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Netmaker platform distributed by gravitl. All deployments running versions earlier than 1.5.0 are susceptible. Later releases contain a fix that removes the API exposure of private keys.", "description_and_impact": "Netmaker enables the creation of WireGuard-based virtual networks. Prior to version\u202f1.5.0, a user assigned the platform\u2011user role could retrieve the private keys of all WireGuard configurations in a network by calling the API endpoints GET /api/extclients/{network} or GET /api/nodes/{network}. The API returned full records, including private keys, without filtering them, contrary to the UI restrictions. This flaw allows an attacker to obtain the keys that grant full network access, and based on the description it is inferred that this could enable them to impersonate nodes or compromise network confidentiality, but the description does not specify precise downstream effects. Based on the description, it is inferred that this access could facilitate unauthorized network participation.", "risk_and_exploitability": "The flaw carries a CVSS score of 8.7, indicating high severity. The EPSS score is below 1\u202f%, suggesting exploitation is unlikely currently. The vulnerability is not listed in the CISA KEV catalogue. Attackers with a platform\u2011user account that has network access can use the vulnerable API endpoints to retrieve private keys. It is inferred that gaining the private keys could allow the attacker to bypass usual network authentication, but the description does not detail specific downstream attacks. Based on the description it is inferred that the potential for serious compromise exists, but the precise extent depends on the network context."}}}}, "created": "2026-03-09T10:05:01.216231+00:00", "updated": "2026-04-18T10:00:10.310806+00:00", "vendors": ["gravitl", "gravitl$PRODUCT$netmaker"]}