← Vulnerability feed

Vulnerability record · CVE-2026-38651 · published 28 April 2026

CVE-2026-38651: Netmaker improper verification of cryptographic signature vulnerability

Netmaker · Netmaker

Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validate the JWT signature when verifying host tokens. An attacker can forge a JWT signed with any arbitrary key and use it to impersonate any host in the network, gaining access to sensitive information

8.2 CVSS 3.1 High EPSS 0.44% · top 64.3% CWE-347 · Improper verification of cryptographic signature
8.2CVSS 3.1 base score
0.44%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
5References, 4 tagged exploit
17 Jun 2026Last modified by NVD

Description

Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validate the JWT signature when verifying host tokens. An attacker can forge a JWT signed with any arbitrary key and use it to impersonate any host in the network, gaining access to sensitive information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/gravitl/netmaker/commit/5309aa70d464ef565911369714d661a61481a79b Patch
https://www.zyenra.com/advisories/netmaker-jwt-verification-bypass ExploitThird Party Advisory
https://www.zyenra.com/blog/netmaker-jwt-verification-bypass ExploitThird Party Advisory
https://www.zyenra.com/advisories/netmaker-jwt-verification-bypass/ ExploitThird Party Advisory
https://www.zyenra.com/blog/netmaker-jwt-verification-bypass ExploitThird Party Advisory

Track CVE-2026-38651 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-0664Netmaker vulnerabilityUse of Hard-coded Cryptographic Key in Go github.com/gravitl/netmaker prior to 0.8.5,0.9.4,0.10.0,0.10.1.EPSS 1.7%8.8CVE-2023-32079Netmaker mass assignment vulnerabilityNetmaker makes networks with WireGuard. A Mass assignment vulnerability was found in versions prior to 0.17.1 and 0.18.6 that allows a non-admin user…EPSS 0.87%8.8CVE-2022-36110Netmaker improper authorization vulnerabilityNetmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API…EPSS 0.89%8.8CVE-2022-23650Netmaker hard-coded credentials vulnerabilityNetmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard…EPSS 1.6%8.7CVE-2026-29771Netmaker improper resource shutdown vulnerabilityNetmaker makes networks with WireGuard. Prior to version 1.2.0, the /api/server/shutdown endpoint allows termination of the Netmaker server process v…EPSS 0.42%7.5CVE-2023-32078Netmaker insecure direct object reference vulnerabilityNetmaker makes networks with WireGuard. An Insecure Direct Object Reference (IDOR) vulnerability was found in versions prior to 0.17.1 and 0.18.6 in …EPSS 0.70%7.5CVE-2023-32077Netmaker hard-coded credentials vulnerabilityNetmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users…EPSS 3.5%10.0CVE-2026-5430Wso2 api control plane improper verification of cryptographic signature vulnerabilityThe JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker t…KEVEPSS 0.59%

Source: NIST National Vulnerability Database (record CVE-2026-38651), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.