CVE-2026-38651: Netmaker

High severity, CVSS 8.2. EPSS: 0.4% chance of exploitation in the next 30 days.

Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validate the JWT signature when verifying host tokens. An attacker can forge a JWT signed with any arbitrary key and use it to impersonate any host in the network, gaining access to sensitive information

Affected products

• Netmaker Netmaker: before 1.5.0 (fixed in 1.5.0)

Published 2026-04-28. Last modified 2026-06-17.