CVE-2026-29771 Netmaker: Denial of Service via Server Shutdown Endpoint

What is CVE-2026-29771?

CVE-2026-29771 is a high-severity denial of service vulnerability in gravitl netmaker, published on 7 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Netmaker makes networks with WireGuard. Prior to version 1.2.0, the /api/server/shutdown endpoint allows termination of the Netmaker server process via syscall.SIGINT. This allows any user to repeatedly shut down the server, causing cyclic denial of service with approximately 3-second restart intervals. This issue has been patched in version 1.2.0.

Weakness: CWE-404

Which versions are affected by CVE-2026-29771?

3 open source packages ship an affected version, including github.com/gravitl/netmaker. It affects 1 product.

Products include Netmaker Netmaker.

How do I fix CVE-2026-29771?

Upgrade github.com/gravitl/netmaker to 1.2.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-29771 being exploited?

There is no known exploitation of CVE-2026-29771 in the wild and no public exploit code.

Other vulnerabilities in gravitl netmaker

• CVE-2023-32079 Netmaker Privilige Escalation Vulnerability High 8.8
• CVE-2022-36110 Netmaker vulnerable to Insufficient Granularity of Access Control High 8.8
• CVE-2022-0664 Use of Hard-coded Cryptographic Key in gravitl/netmaker High 8.8
• CVE-2026-38651 Netmaker does not verify JWT signatures for host tokens High 8.2
• CVE-2023-32077 Netmaker has Hardcoded DNS Secret Key High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rhr9-hgcm-x289, GO-2026-4608.