CVE-2026-32599

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-32599
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32599.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-32599
Aliases
Published
2026-09-15T19:49:26Z
Modified
2026-09-18T03:30:38Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Netmaker has a boolean‑based SQL Injection
Details

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the sqliteDeleteRecord function in Netmaker's database layer constructs SQL DELETE statements using direct string concatenation of user-supplied input. This allows an authenticated attacker to perform boolean-based SQL injection. Version 1.5.0 fixes the issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32599.json"
}
References

Affected packages

Git / github.com/gravitl/netmaker

Affected ranges

Type
GIT
Repo
https://github.com/gravitl/netmaker
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6b7d33fa7749c87e6b3c59b1a544d80c727c478b
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.5.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.7
v0.*
v0.1
v0.10.0
v0.11.0
v0.11.1-testing
v0.11.1_testing
v0.12.0
v0.13.5-testing
v0.14.1
v0.14.1-testing
v0.14.2
v0.14.3
v0.14.4
v0.14.5
v0.14.6
v0.15.1
v0.15.2
v0.16.0
v0.16.1
v0.16.2
v0.17.0
v0.18.0
v0.18.1
v0.18.2
v0.18.3
v0.18.4
v0.18.6
v0.18.7
v0.19.0
v0.20.0
v0.20.1
v0.20.2
v0.20.3
v0.20.4
v0.20.5
v0.20.6
v0.21.0
v0.21.1
v0.21.2
v0.22.0
v0.23.0
v0.24.0
v0.24.1
v0.24.2
v0.24.3
v0.25.0
v0.26.0
v0.3
v0.30.0
v0.5
v0.7
v0.7.1
v0.8.0
v0.9.0
v0.9.1
v0.9.2
v0.9.3
v0.9.4
v0.90.0
v0.99.0
v1.*
v1.0.0
v1.1.0
v1.2.0
v1.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32599.json"