UNKNOWN Go
Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys
GHSA-4hgg-c4rr-6h7f · CVE-2026-29196 · GO-2026-4651
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
A user assigned the platform-user role can retrieve WireGuard private keys of all wireguard configs in a network by calling GET /api/extclients/{network} or GET /api/nodes/{network}. While the Netmaker UI restricts visibility, the API endpoints return full records, including private keys, without filtering based on the requesting user's ownership.
Credits
Artem Danilov (Positive Technologies)
Ready to move
Start Securing
Free, no credit card | First findings in minutes