CVE-2026-32599

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-32599

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32599.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-32599

Aliases

Published

2026-09-15T19:49:26Z

Modified

2026-10-28T02:30:55Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Netmaker has a boolean‑based SQL Injection

Details

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the sqliteDeleteRecord function in Netmaker's database layer constructs SQL DELETE statements using direct string concatenation of user-supplied input. This allows an authenticated attacker to perform boolean-based SQL injection. Version 1.5.0 fixes the issue.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32599.json"
}

References

Affected packages

Git / github.com/gravitl/netmaker

Affected ranges

Type

GIT

Repo

https://github.com/gravitl/netmaker

Events

Introduced

Fixed

6b7d33fa7749c87e6b3c59b1a544d80c727c478b

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.5.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "original_tag": "v1.5.0",
            "range": [
                {
                    "fixed": "6b7d33fa7749c87e6b3c59b1a544d80c727c478b"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.5.0"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

Affected versions

0.*

0.7

v0.*

v0.1

v0.10.0

v0.11.0

v0.11.1-testing

v0.11.1_testing

v0.12.0

v0.13.5-testing

v0.14.1

v0.14.1-testing

v0.14.2

v0.14.3

v0.14.4

v0.14.5

v0.14.6

v0.15.1

v0.15.2

v0.16.0

v0.16.1

v0.16.2

v0.17.0

v0.18.0

v0.18.1

v0.18.2

v0.18.3

v0.18.4

v0.18.6

v0.18.7

v0.19.0

v0.20.0

v0.20.1

v0.20.2

v0.20.3

v0.20.4

v0.20.5

v0.20.6

v0.21.0

v0.21.1

v0.21.2

v0.22.0

v0.23.0

v0.24.0

v0.24.1

v0.24.2

v0.24.3

v0.25.0

v0.26.0

v0.3

v0.30.0

v0.5

v0.7

v0.7.1

v0.8.0

v0.9.0

v0.9.1

v0.9.2

v0.9.3

v0.9.4

v0.90.0

v0.99.0

v1.*

v1.0.0

v1.1.0

v1.2.0

v1.4.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32599.json"