CVE-2026-29196

CVE-2026-29196 describes a critical information disclosure vulnerability in Netmaker versions prior to 1.5.0, allowing users with the platform-user role to retrieve WireGuard private keys for all network configurations. This flaw stems from API endpoints (GET /api/extclients/{network} and GET /api/nodes/{network}) returning full records without proper filtering, despite UI restrictions. With a CVSS score of 8.7 (HIGH), this vulnerability presents a significant risk of unauthorized access to sensitive network credentials due to its low attack complexity and lack of user interaction required. While there is currently no evidence of active exploitation, public exploit code, or significant community discussion, the potential for compromise remains high.