CVE-2026-29194: 
NixOS vulnerability analysis and mitigation

CVE-2026-29194 is an Incorrect Authorization vulnerability in Netmaker, a WireGuard-based network management platform, affecting all versions prior to 1.5.0. The flaw resides in the Authorize middleware, which incorrectly validates host JWT tokens — when a route permits host authentication (hostAllowed=true), a valid host token bypasses all subsequent authorization checks without verifying the host's access rights to the specific requested resource. It was discovered by Artem Danilov of Positive Technologies and disclosed on March 7, 2026, with a patch released in version 1.5.0. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 8.6 (High) (Github Advisory, Netmaker Advisory).

The root cause is classified as CWE-863 (Incorrect Authorization): the Authorize middleware in Netmaker confirms that a presented JWT is a valid host token but fails to verify that the authenticated host is actually authorized to access the specific resource being requested. This means any attacker holding a legitimately issued host token — even for a different host — can supply that token in API requests targeting arbitrary node IDs or host IDs they have enumerated or guessed. Affected API endpoints include node info retrieval, host deletion, MQTT signal transmission, fallback host updates, and failover operations. The attack requires only low privileges (a valid host token) and no user interaction, and is exploitable remotely over the network (Github Advisory, Netmaker Advisory).

Successful exploitation allows a low-privileged attacker with any valid host token to access, modify, or delete resources belonging to other hosts across the Netmaker-managed network. Concretely, an attacker can retrieve sensitive node configuration information, delete arbitrary hosts from the network, inject or manipulate MQTT signals, alter fallback host configurations, and trigger failover operations — all without proper authorization. This represents a significant breach of network isolation and access controls, potentially enabling lateral movement across WireGuard network segments and disruption of network topology (Github Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.036% (11th percentile), indicating a low near-term exploitation probability. The vulnerability was reported by Artem Danilov of Positive Technologies (Github Advisory).

1. Obtain a valid host token: Register or compromise any host within the Netmaker deployment to obtain a legitimately issued host JWT token. Even a token for a low-privilege or attacker-controlled host is sufficient.
2. Enumerate target identifiers: Gather node IDs or host IDs of other hosts in the network. These may be discoverable through API responses, network traffic, or administrative interfaces accessible to enrolled hosts.
3. Craft a malicious API request: Construct an HTTP request targeting a vulnerable endpoint (e.g., node info retrieval, host deletion, MQTT signal, fallback host update, or failover operation) using the target host's or node's identifier in the URL or request body.
4. Supply the attacker's host token: Include the attacker's own valid host JWT in the Authorization header. The Authorize middleware will accept it as valid without checking whether the token's host matches the requested resource.
5. Achieve unauthorized access or modification: The server processes the request as authorized, allowing the attacker to read sensitive node configurations, delete target hosts, send MQTT signals, modify fallback configurations, or trigger failover operations on resources belonging to other hosts (Netmaker Advisory, Github Advisory).

• Network: Unusual API requests to Netmaker endpoints (node info, host deletion, MQTT signal, fallback host update, failover) where the host ID in the JWT token does not match the resource ID in the request path or body.
• Logs: Netmaker API access logs showing a single host token used to access or modify multiple different host/node resources; repeated cross-host resource access patterns from the same token identity.
• Logs: Unexpected host deletion events or failover triggers in Netmaker audit/event logs not initiated by the resource owner.
• Network: Anomalous MQTT messages originating from hosts that do not own the targeted node, or unexpected changes to fallback host configurations.
• Application: Sudden changes in network topology, missing hosts, or altered egress/failover configurations not correlated with administrative actions (Netmaker Advisory).

The primary remediation is to upgrade Netmaker to version 1.5.0 or later, which corrects the authorization logic in the Authorize middleware to properly verify that the authenticated host token corresponds to the specific resource being accessed (Netmaker Advisory, v1.5.0 Release). Until patching is complete, administrators should implement network segmentation to limit which hosts can reach the Netmaker API, enforce strict monitoring of API calls to the affected endpoints (node info retrieval, host deletion, MQTT signal transmission, fallback host updates, and failover operations), and audit host token usage for anomalous cross-host access patterns (Feedly).

The vulnerability was discovered and reported by Artem Danilov of Positive Technologies, credited in the official GitHub Security Advisory (Netmaker Advisory). No significant broader media coverage or notable community commentary beyond standard vulnerability database aggregation has been observed at this time.