CVE-2026-29195 Netmaker: Privilege Escalation from Admin to Super-Admin via User Update

What is CVE-2026-29195?

CVE-2026-29195 is a medium-severity vulnerability in gravitl netmaker, published on 7 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the user update handler (PUT /api/users/{username}) lacks validation to prevent an admin-role user from assigning the super-admin role during account updates. While the code correctly blocks an admin from assigning the admin role to another user, it does not include an equivalent check for the super-admin role. This issue has been patched in version 1.5.0.

Weakness: CWE-863

Which versions are affected by CVE-2026-29195?

3 open source packages ship an affected version, including github.com/gravitl/netmaker. It affects 1 product.

Products include Gravitl Netmaker.

How do I fix CVE-2026-29195?

Upgrade github.com/gravitl/netmaker to 1.5.0 or later.

Is CVE-2026-29195 being exploited?

There is no known exploitation of CVE-2026-29195 in the wild and no public exploit code.

Other vulnerabilities in gravitl netmaker

• CVE-2026-29196 Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys High 8.7
• CVE-2026-29194 Netmaker: Insufficient Authorization in Host Token Verification High 8.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-ch3w-9456-38v3, GO-2026-4654.