CVE-2026-38651 - Vulnerability Analysis

Overview

Netmaker < 1.5.0 contains an authentication bypass caused by improper JWT signature validation in VerifyHostToken function, letting attackers forge tokens to impersonate hosts and access sensitive information, exploit requires network access.

Severity & Score

Impact

Attackers can impersonate any host to access sensitive network information, compromising confidentiality and trust.

Mitigation

Update to version 1.5.0 or later.

References

• https://github.com/gravitl/netmaker/commit/5309aa70d464ef565911369714d661a61481a79b
• https://www.zyenra.com/advisories/netmaker-jwt-verification-bypass
• https://www.zyenra.com/blog/netmaker-jwt-verification-bypass
• https://www.zyenra.com/advisories/netmaker-jwt-verification-bypass/

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner