Improper Certificate Validation in Netmaker - CVE-2026-81034
Published: November 6, 2026
Vulnerability identifier: #VU159647
CSH Severity: Medium
CVSS v4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-81034
CWE-ID: CWE-295
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to access sensitive outgoing Netmaker email content, including password-reset tokens and user invitation links.
The vulnerability exists due to missing TLS certificate and hostname validation when Netmaker connects to an administrator-configured SMTP server in deployments using SMTP email functionality. An unauthenticated remote attacker can intercept or redirect that connection and present an untrusted certificate to impersonate the SMTP server and receive outgoing messages.
Affected software
Netmaker
How to mitigate CVE-2026-81034
Install security update from vendor's website.
Netmaker - update to 1.6.0