CVE-2026-29771: 
NixOS vulnerability analysis and mitigation

CVE-2026-29771 is a Denial of Service vulnerability in Netmaker's /api/server/shutdown endpoint that allows any unauthenticated user to terminate the server process by sending a syscall.SIGINT signal. The vulnerability affects all Netmaker versions prior to 1.2.0 and was published on March 4, 2026, with NVD publication following on March 7, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Netmaker Advisory).

The root cause is classified as CWE-404 (Improper Resource Shutdown or Release): the /api/server/shutdown API endpoint lacks any authentication or authorization check before invoking syscall.SIGINT to terminate the server process. An attacker with network access can send repeated HTTP requests to this endpoint without any credentials, privileges, or user interaction, causing the server to restart in a cyclic loop with approximately 3-second intervals between each shutdown and restart. No complex preconditions are required — the endpoint is reachable over the network and exploitable by any user who can reach the API (GitHub Advisory, Netmaker Advisory).

Successful exploitation results in a cyclic denial of service condition, rendering the Netmaker server continuously unavailable to legitimate users and managed network nodes. Because Netmaker functions as a WireGuard-based network management platform, disruption of the server can impair VPN connectivity and network management operations for all connected clients. There is no confidentiality or integrity impact — the attack is purely an availability concern, but the ease of exploitation and the cyclic nature of the disruption make it particularly disruptive in production environments (GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.042% (6th percentile), indicating a low current probability of exploitation in the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Despite the low EPSS, the attack is trivially simple to execute — a single unauthenticated HTTP request to the shutdown endpoint is sufficient to trigger the condition (GitHub Advisory, Netmaker Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible Netmaker server instances running versions prior to 1.2.0 using tools like Shodan, Censys, or direct network scanning for the Netmaker API port.
2. Locate the shutdown endpoint: Confirm the target exposes the /api/server/shutdown endpoint, which requires no authentication in vulnerable versions.
3. Send shutdown request: Issue an HTTP request (e.g., curl -X POST http://<target>:<port>/api/server/shutdown) to trigger the syscall.SIGINT signal and terminate the server process.
4. Repeat for cyclic DoS: Automate repeated requests (e.g., via a loop script) to continuously shut down the server each time it restarts, maintaining a denial of service with approximately 3-second restart intervals (GitHub Advisory).

• Network: Repeated HTTP POST or GET requests to /api/server/shutdown from one or more source IP addresses, especially at high frequency or in automated patterns.
• Logs: Netmaker server logs showing repeated process termination and restart events within short intervals (approximately every 3 seconds); API access logs recording requests to the shutdown endpoint from unexpected or unauthorized sources.
• Process: Repeated Netmaker server process restarts observable via system process monitoring tools (e.g., systemd journal entries showing frequent service restarts for the Netmaker unit).

The primary remediation is to upgrade Netmaker to version 1.2.0 or later, which patches this vulnerability (GitHub Advisory, Netmaker Advisory). As an interim workaround for deployments that cannot immediately upgrade, implement network-level access controls (firewall rules or API gateway policies) to restrict access to the /api/server/shutdown endpoint to only authorized administrative IP addresses. Additionally, consider deploying rate limiting on API endpoints and enabling monitoring/alerting for unusual shutdown request patterns to detect and respond to ongoing attacks.

The vulnerability was discovered and reported by security researcher m4dn355 and published by the Netmaker maintainer abhishek9686 on March 4, 2026 (Netmaker Advisory). An openSUSE security announcement was also issued referencing this CVE (openSUSE). No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database aggregation.