SB2026110654 - Multiple vulnerabilities in Netmaker

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110654

SB2026110654 - Multiple vulnerabilities in Netmaker

Published: November 6, 2026

Security Bulletin ID SB2026110654
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper Certificate Validation (CVE-ID: CVE-2026-81034)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to access sensitive outgoing Netmaker email content, including password-reset tokens and user invitation links.

The vulnerability exists due to missing TLS certificate and hostname validation when Netmaker connects to an administrator-configured SMTP server in deployments using SMTP email functionality. An unauthenticated remote attacker can intercept or redirect that connection and present an untrusted certificate to impersonate the SMTP server and receive outgoing messages.


Remediation

Install update from vendor's website.

References