MEDIUM

CVE-2026-32599

2026-09-15 CVSS v4.0

CVSS

5.3

Description

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the `sqliteDeleteRecord` function in Netmaker's database layer constructs SQL `DELETE` statements using direct string concatenation of user-supplied input. This allows an authenticated attacker to perform boolean-based SQL injection. Version 1.5.0 fixes the issue.

Weakness (CWE)

CWE-89 SQL Injection

EPSS Score

0.26%

Probability of exploitation in next 30 days

18.2th percentile

References

https://github.com/gravitl/netmaker/releases/tag/v1.5.0 https://github.com/gravitl/netmaker/security/advisories/GHSA-r8cr-4f9w-7r75

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE