Netmaker enables the creation of WireGuard-based virtual networks. Prior to version 1.5.0, a user assigned the platform‑user role could retrieve the private keys of all WireGuard configurations in a network by calling the API endpoints GET /api/extclients/{network} or GET /api/nodes/{network}. The API returned full records, including private keys, without filtering them, contrary to the UI restrictions. This flaw allows an attacker to obtain the keys that grant full network access, and based on the description it is inferred that this could enable them to impersonate nodes or compromise network confidentiality, but the description does not specify precise downstream effects. Based on the description, it is inferred that this access could facilitate unauthorized network participation.

The vulnerability affects the Netmaker platform distributed by gravitl. All deployments running versions earlier than 1.5.0 are susceptible. Later releases contain a fix that removes the API exposure of private keys.

The flaw carries a CVSS score of 8.7, indicating high severity. The EPSS score is below 1 %, suggesting exploitation is unlikely currently. The vulnerability is not listed in the CISA KEV catalogue. Attackers with a platform‑user account that has network access can use the vulnerable API endpoints to retrieve private keys. It is inferred that gaining the private keys could allow the attacker to bypass usual network authentication, but the description does not detail specific downstream attacks. Based on the description it is inferred that the potential for serious compromise exists, but the precise extent depends on the network context.