CVE-2026-29195: 
NixOS vulnerability analysis and mitigation

CVE-2026-29195 is a privilege escalation vulnerability in Netmaker, a WireGuard-based network management platform developed by Gravitl. The flaw allows an authenticated admin-role user to escalate their privileges to super-admin by exploiting missing input validation in the user update API handler (PUT /api/users/{username}). All Netmaker versions prior to 1.5.0 are affected. The vulnerability was discovered by Artem Danilov of Positive Technologies and disclosed on March 7, 2026. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 6.9 (Medium) (Github Advisory, Red Hat CVE).

The root cause is an Incorrect Authorization flaw (CWE-863) in the user update handler. While the handler correctly prevents an admin from assigning the admin role to another user, it lacks an equivalent guard against assigning the super-admin role — creating an authorization bypass. An attacker with a valid admin-level session can send a crafted PUT /api/users/{username} API request with the super-admin role field set, and the server will accept and apply the role change without restriction. No special configuration or additional preconditions beyond holding an admin account are required (Github Advisory, Netmaker Advisory).

Successful exploitation grants the attacker unrestricted super-admin control over the Netmaker instance, including the ability to modify network configurations, manage all user accounts and permissions, and manipulate WireGuard network operations. This represents a full integrity compromise of the network management plane, potentially enabling an attacker to reconfigure peer-to-peer tunnels, add or remove network nodes, and pivot across managed networks. There is no direct confidentiality or availability impact reported, but the elevated access could facilitate further attacks against connected infrastructure (Github Advisory, Red Hat CVE).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.015% (4th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid admin-level account, which limits the attacker pool but does not eliminate insider threat or compromised credential scenarios (Github Advisory, Red Hat CVE).

1. Obtain Admin Credentials: Acquire a valid admin-role account on the target Netmaker instance, either through legitimate access, credential theft, or social engineering.
2. Authenticate to the API: Use the admin credentials to authenticate against the Netmaker API and obtain a valid session token or JWT.
3. Craft Malicious PUT Request: Construct a PUT /api/users/{username} request targeting the admin's own username (or another user's username), with the request body containing a role field set to super-admin (e.g., {"role": "super-admin"}).
4. Submit the Request: Send the crafted request to the Netmaker API endpoint. Due to the missing validation check, the server accepts the role assignment without restriction.
5. Verify Privilege Escalation: Confirm the account now holds super-admin privileges by querying user details or accessing super-admin-only API endpoints.
6. Abuse Elevated Access: Use the super-admin role to modify network configurations, manage other users, alter WireGuard peer settings, or perform other privileged operations across the managed network infrastructure (Github Advisory, Netmaker Advisory).

• Network: Unexpected PUT /api/users/{username} API requests from admin-role accounts, particularly those modifying role fields; API calls to super-admin-only endpoints from accounts that were previously admin-level.
• Logs: Netmaker API access logs showing role update requests with super-admin values in the request body from non-super-admin sessions; sudden appearance of new super-admin accounts or unexpected role changes in audit logs.
• Application State: Presence of user accounts with super-admin role that were not explicitly provisioned by a legitimate super-admin; unexpected changes to network configurations, peer lists, or access control policies shortly after a role change event.

The primary remediation is to upgrade Netmaker to version 1.5.0 or later, which includes a patch that adds the missing super-admin role assignment validation to the user update handler (Netmaker Release, Github Advisory). As an interim measure for organizations unable to upgrade immediately, implement strict monitoring and alerting on the PUT /api/users/{username} API endpoint to detect unauthorized role modification attempts. Additionally, audit all existing user accounts to verify no unauthorized super-admin accounts have been created, and apply network-level access controls to restrict API access to trusted IP ranges.

The vulnerability was credited to Artem Danilov of Positive Technologies, a well-known security research firm, and was published as a GitHub Security Advisory by the Netmaker maintainer abhishek9686 on March 7, 2026 (Netmaker Advisory). Red Hat also tracked the vulnerability in their security advisory database (Red Hat CVE). No significant broader media coverage or notable community controversy has been observed beyond standard vulnerability database aggregation.