8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-38651

CVE-2026-38651: Netmaker does not verify JWT signatures for host tokens

Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validate the JWT signature when verifying host tokens. An attacker can forge a JWT signed with any arbitrary key and use it to impersonate any host in the network, gaining access to sensitive information

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-38651

CVE-2026-38651:

8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/gravitl/netmaker	go	< 1.5.0	1.5.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the VerifyHostToken function in logic/jwts.go, which is responsible for verifying JWTs for host authentication. The original implementation failed to check the validity of the JWT signature, only verifying that the token was not nil. This allows an attacker to forge a JWT with arbitrary claims, bypassing authentication and gaining access to sensitive host information. The patch addresses this by adding a check for token.Valid in VerifyHostToken. Additionally, the Authorize middleware in controllers/node.go was using the vulnerable VerifyHostToken function. The patch refactors this middleware into AuthorizeHost and replaces its usage in various API endpoints, ensuring that all host authentication now uses the corrected token validation logic.

Vulnerable functions

logic.VerifyHostToken

logic/jwts.go

The function `VerifyHostToken` in `logic/jwts.go` did not properly validate JWT signatures. The original code only checked if the token was not nil, but did not check the `token.Valid` field. This allowed an attacker to forge a JWT with any key and gain unauthorized access.

controller.Authorize

controllers/node.go

The `Authorize` function in `controllers/node.go` was a middleware that handled authorization for various API endpoints. It called the vulnerable `logic.VerifyHostToken` function, making all endpoints that used this middleware vulnerable. The patch replaced this function with `AuthorizeHost`, which correctly validates the token.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.