PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-38651 Netmaker CVE debrief

A critical authentication bypass vulnerability in Netmaker versions prior to 1.5.0 allows attackers to forge JWT tokens and impersonate any host in the network. The root cause is a missing signature validation in the VerifyHostToken function within logic/jwts.go, enabling attackers to sign tokens with arbitrary keys. This flaw permits unauthorized access to sensitive network information without requiring any privileges or user interaction. The vulnerability was disclosed on April 28, 2026, with the NVD record last modified on May 18, 2026. A patch is available via commit 5309aa70d464ef565911369714d661a61481a79b. Third-party security researchers have published detailed technical analysis and proof-of-concept exploitation guidance. Organizations should upgrade to Netmaker 1.5.0 or later immediately and rotate any existing host tokens as a precautionary measure.

Vendor
Netmaker
Product
Netmaker
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-28
Original CVE updated
2026-05-18
Advisory published
2026-04-28
Advisory updated
2026-05-18

Who should care

Organizations operating Netmaker-based overlay networks for multi-cloud or distributed infrastructure connectivity; security teams managing zero-trust network architectures; DevOps engineers responsible for network automation and wireguard mesh deployments; compliance officers overseeing network segmentation controls

Technical summary

The VerifyHostToken function in Netmaker's logic/jwts.go fails to validate JWT signatures when processing host tokens. This cryptographic verification flaw (CWE-347) allows attackers to craft valid-appearing JWTs signed with any arbitrary key, bypassing authentication entirely. Successful exploitation grants complete host impersonation capabilities within the Netmaker network, exposing sensitive network topology, node configurations, and traffic routing information. The attack requires no authentication, no user interaction, and can be executed remotely with low complexity. The vulnerability affects all Netmaker versions before 1.5.0.

Defensive priority

critical

Recommended defensive actions

  • Upgrade Netmaker to version 1.5.0 or later immediately
  • Review and rotate all existing host authentication tokens
  • Audit network access logs for anomalous host authentication patterns
  • Verify JWT signature validation is enforced in custom Netmaker deployments
  • Monitor for unauthorized host registrations or network topology changes

Evidence notes

The vulnerability description is sourced from the official CVE record and NVD entry. The affected version range (prior to 1.5.0) is confirmed through CPE criteria in the NVD data. The patch commit is explicitly tagged as such in the reference metadata. Third-party advisory sources are marked as 'Exploit' and 'Third Party Advisory' in reference tags, indicating available technical documentation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) supports the HIGH severity rating with network attack vector, low complexity, no privileges required, and high confidentiality impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-38651 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-38651

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-38651 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-38651

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.