CVE-2026-38651

Katalog CVE

CVSS 8.2 · High EPSS 0,44%

Kerentanan Improper Verification of Cryptographic Signature pada netmaker. Skor CVSS 3.1 8.2 (High) menurut CISA ADP.

Deskripsi (NVD)

Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validate the JWT signature when verifying host tokens. An attacker can forge a JWT signed with any arbitrary key and use it to impersonate any host in the network, gaining access to sensitive information

Rincian

Terbit di NVD

28 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.2 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gravitl/netmaker/commit/5309aa70d464ef565911369714d661a61481a79b patch
• https://www.zyenra.com/advisories/netmaker-jwt-verification-bypass exploit · advisory pihak ketiga
• https://www.zyenra.com/blog/netmaker-jwt-verification-bypass exploit · advisory pihak ketiga
• https://www.zyenra.com/advisories/netmaker-jwt-verification-bypass/ exploit · advisory pihak ketiga