CVE-2026-32599— Netmaker has a boolean‑based SQL Injection
Quick assessment
Affected
gravitl netmaker
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Netmaker 使用 WireGuard 构建网络。在 1.5.0 版本之前，Netmaker 数据库层中的 函数通过直接拼接用户提供的输入来构建 SQL 语句。这使得经过身份验证的攻击者能够执行基于布尔值的 SQL 注入。该问题在 1.5.0 版本中已修复。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-32599
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Netmaker has a boolean‑based SQL Injection
Source: CVE Program / CVE List V5
Vulnerability Description
Netmaker makes networks with WireGuard. Prior to version 1.5.0, the `sqliteDeleteRecord` function in Netmaker's database layer constructs SQL `DELETE` statements using direct string concatenation of user-supplied input. This allows an authenticated attacker to perform boolean-based SQL injection. Version 1.5.0 fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-32599
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-32599
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-32599 (1)
Other References for CVE-2026-32599 (1)
-
Release v1.5.0 · gravitl/netmaker · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: netmaker
-
CVE-2026-81034
Netmaker through 1.6.0 Improper Certificate Validation in SM -
CVE-2026-29196
Netmaker: Service User with Network Access Can Access config -
CVE-2026-29195
Netmaker: Privilege Escalation from Admin to Super-Admin via -
CVE-2026-29194
Netmaker: Insufficient Authorization in Host Token Verificat -
CVE-2026-29771
Netmaker: Denial of Service via Server Shutdown Endpoint
Same vendor: gravitl
-
CVE-2026-81034
Netmaker through 1.6.0 Improper Certificate Validation in SM -
CVE-2026-29196
Netmaker: Service User with Network Access Can Access config -
CVE-2026-29195
Netmaker: Privilege Escalation from Admin to Super-Admin via -
CVE-2026-29194
Netmaker: Insufficient Authorization in Host Token Verificat -
CVE-2026-29771
Netmaker: Denial of Service via Server Shutdown Endpoint
Same weakness: CWE-89
-
CVE-2026-81567
Joomla Extension - j2commerce.com - Unauthenticated blind SQ -
CVE-2026-61667
DIRAC: RCE in FileCatalog DatasetManager via SQL injection + -
CVE-2024-58385
Yonyou U8 CRM SQL Injection via fillbacksettingedit.php -
CVE-2026-81895
Concrete CMS 9.5.2 and below is vulnerable to Stored SQL Inj -
CVE-2026-81894
Concrete CMS 9.5.2 and below is vulnerable to Stored DOM-bas
V. Comments for CVE-2026-32599
No comments yet