CVE-2026-38651 Netmaker does not verify JWT signatures for host tokens

What is CVE-2026-38651?

CVE-2026-38651 is a high-severity authentication bypass vulnerability in n/a, published on 28 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validate the JWT signature when verifying host tokens. An attacker can forge a JWT signed with any arbitrary key and use it to impersonate any host in the network, gaining access to sensitive information

Weakness: CWE-347

Which versions are affected by CVE-2026-38651?

3 open source packages ship an affected version, including github.com/gravitl/netmaker. It affects 1 product.

Products include Netmaker Netmaker.

How do I fix CVE-2026-38651?

Upgrade github.com/gravitl/netmaker to 1.5.0 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-38651 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-38651 exists.

Other vulnerabilities in n/a

• CVE-2023-32079 Netmaker Privilige Escalation Vulnerability High 8.8
• CVE-2022-36110 Netmaker vulnerable to Insufficient Granularity of Access Control High 8.8
• CVE-2022-0664 Use of Hard-coded Cryptographic Key in gravitl/netmaker High 8.8
• CVE-2026-29771 Netmaker: Denial of Service via Server Shutdown Endpoint High 8.7
• CVE-2023-32077 Netmaker has Hardcoded DNS Secret Key High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qpv2-rwc8-c993, GO-2026-5588.