PT-2026-23870 · Wireguard+1 · Wireguard+1

Artem Danilov · Published 2025-08-08 · Updated 2026-03-25 · CVE-2026-29195

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Netmaker versions prior to 1.5.0

Description Netmaker, which utilizes WireGuard, has an issue where the user update handler does not properly validate role assignments. Specifically, an administrator-role user can assign the super-admin role to another user via the PUT /api/users/{username} API endpoint. The system prevents an administrator from assigning the administrator role, but lacks a similar check for the super-admin role. The vulnerable parameter is username.

Recommendations Update to version 1.5.0 or later.

Exploit

Fix

LPE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2026-03335

CVE-2026-29195

GHSA-CH3W-9456-38V3

GO-2026-4654

SUSE-SU-2026:1042-1

Affected Products

Netmaker

Wireguard

References · 141

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29195.json · Exploit
• https://github.com/gravitl/netmaker/security/advisories/GHSA-ch3w-9456-38v3 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03335 · Security Note
• https://osv.dev/vulnerability/GO-2026-4654 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-29195 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29195 · Security Note
• https://osv.dev/vulnerability/GHSA-ch3w-9456-38v3 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://github.com/gravitl/netmaker · Note
• https://github.com/gravitl/netmaker/releases/tag/v1.5.0 · Note
• https://suse.com/security/cve/CVE-2026-28789 · Note
• https://suse.com/security/cve/CVE-2026-29781 · Note
• https://suse.com/security/cve/CVE-2026-27808 · Note
• https://suse.com/security/cve/CVE-2026-31886 · Note
• https://suse.com/security/cve/CVE-2026-23999 · Note