CVE-2026-29196: 
NixOS vulnerability analysis and mitigation

CVE-2026-29196 is an incorrect authorization vulnerability in Netmaker, a WireGuard-based network management platform developed by Gravitl. Prior to version 1.5.0, users assigned the platform-user role can retrieve WireGuard private keys for all network configurations by calling the GET /api/extclients/{network} or GET /api/nodes/{network} API endpoints, which return full records without ownership-based filtering. The vulnerability was discovered by Artem Danilov of Positive Technologies and disclosed on March 7, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 8.7 (High) (Github Advisory, Netmaker Advisory).

The root cause is CWE-863 (Incorrect Authorization): the Netmaker API performs an authorization check to verify that a user is authenticated with the platform-user role, but fails to enforce ownership-based filtering when returning WireGuard configuration records. As a result, the API endpoints GET /api/extclients/{network} and GET /api/nodes/{network} return complete records — including WireGuard private keys — for all configurations in a network, regardless of which resources the requesting user owns or manages. The Netmaker UI correctly restricts visibility of private keys, but this protection is entirely bypassed by directly querying the API. Exploitation requires only a valid platform-user account and network-level access to the API (Github Advisory, Netmaker Advisory).

Successful exploitation allows a low-privileged platform-user to obtain WireGuard private keys for every node and external client configuration in a network, representing a complete confidentiality compromise of all VPN cryptographic material. With these private keys, an attacker can decrypt VPN traffic, impersonate any network endpoint, and potentially pivot laterally across the entire WireGuard network. There is no integrity or availability impact, but the exposure of private keys effectively undermines the security guarantees of the entire WireGuard network managed by the affected Netmaker instance (Github Advisory, Feedly).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation as of the time of reporting (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.041% (roughly the 3rd percentile), indicating a low near-term probability of exploitation (Github Advisory). The vulnerability was credited to Artem Danilov of Positive Technologies, suggesting responsible disclosure through a security research context.

1. Obtain platform-user credentials: Acquire valid credentials for a Netmaker account assigned the platform-user role — this could be through social engineering, credential theft, or a legitimately provisioned low-privilege account.
2. Authenticate to the Netmaker API: Use the credentials to authenticate against the Netmaker API and obtain a valid session token or JWT.
3. Enumerate available networks: Query the Netmaker API to identify network names accessible to the platform, e.g., GET /api/networks.
4. Retrieve WireGuard private keys via extclients endpoint: Send an authenticated request such as GET /api/extclients/{network} for each discovered network. The API returns full records including WireGuard private keys for all external client configurations, regardless of ownership.
5. Retrieve node private keys: Similarly, send GET /api/nodes/{network} to retrieve full node records including WireGuard private keys for all nodes in the network.
6. Leverage private keys: Use the harvested private keys to configure a WireGuard client capable of decrypting VPN traffic or impersonating legitimate network endpoints, enabling traffic interception or lateral movement within the network (Github Advisory, Netmaker Advisory).

• Network: Unusual or repeated GET requests to /api/extclients/{network} or /api/nodes/{network} from accounts with the platform-user role, especially if the requesting user does not own the queried resources; API calls originating from unexpected IP addresses or geographic locations for known platform-user accounts.
• Logs: Netmaker API access logs showing platform-user accounts querying node or extclient endpoints across multiple networks in rapid succession; authentication events followed immediately by bulk API enumeration activity.
• Behavioral: A platform-user account accessing API endpoints directly (bypassing the UI) or making API calls outside of normal business hours; new WireGuard peer configurations appearing in the network that do not correspond to known provisioned devices.

The primary remediation is to upgrade Netmaker to version 1.5.0 or later, which patches the authorization logic to enforce ownership-based filtering on the affected API endpoints (Netmaker Release, Github Advisory). For environments that cannot patch immediately, implement network-level access controls (e.g., firewall rules or API gateway policies) to restrict access to the /api/extclients/{network} and /api/nodes/{network} endpoints to only trusted, authorized users. Additionally, audit all current platform-user role assignments and limit this role to only personnel who strictly require it, reducing the attack surface until patching is complete.

The vulnerability was discovered and responsibly disclosed by Artem Danilov of Positive Technologies, a well-known security research firm (Netmaker Advisory). The advisory was published by the Netmaker maintainer (abhishek9686) on March 7, 2026, and the fix was included in the v1.5.0 release. No significant broader media coverage or notable community debate has been identified beyond standard vulnerability database aggregation.