GitHub Advisoryadvisory · Go
GHSA-qpv2-rwc8-c993 Netmaker does not verify JWT signatures for host tokens
CRITICAL
Official page ↗
- Aliases
- CVE-2026-38651
- Ecosystem
- Go
- Packages
- github.com/gravitl/netmaker
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- Weaknesses
- CWE-347
- Reviewed
- 2026-05-05
Affected packages
• Go github.com/gravitl/netmaker: < 1.5.0 → fixed in 1.5.0
Description
Netmaker by Gravitl is an open-source WireGuard-based networking platform for creating and managing virtual overlay networks. The `VerifyHostToken` function in `logic/jwts.go` does not validate the JWT signature when verifying host tokens. After calling `jwt.ParseWithClaims`, the function only checks whether the returned token object is non-nil. It does not check `token.Valid` or the returned error. An attacker can forge a JWT signed with any key, set the claims to any host ID, and pull that host's full configuration including bcrypt-hashed passwords, MQTT credentials, and WireGuard peer data. The issue was patched in v1.5.0.
Related
Alias · CVE (1)
- CVE-2026-38651 Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. vulnerability
Weakness · CWE (1)
- CWE-347 Improper Verification of Cryptographic Signature weakness