GitHub Advisoryadvisory · Go

GHSA-rhr9-hgcm-x289 Netmaker Vulnerable to Denial of Service via Server Shutdown Endpoint

HIGH Published 2026-03-04 Modified 2026-03-09 Official page ↗
Aliases
CVE-2026-29771
Ecosystem
Go
Packages
github.com/gravitl/netmaker
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-404
Reviewed
2026-03-04

Affected packages

• Go github.com/gravitl/netmaker: < 1.2.0 → fixed in 1.2.0

Description

The /api/server/shutdown endpoint allows termination of the Netmaker server process via syscall.SIGINT. This allows any user to repeatedly shut down the server, causing cyclic denial of service with approximately 3-second restart intervals.

Related

Alias · CVE (1)

  • CVE-2026-29771 Netmaker makes networks with WireGuard. vulnerability

Weakness · CWE (1)

  • CWE-404 Improper Resource Shutdown or Release weakness

References