Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
gravitl/netmaker
develop @ 8c71fcb
249
Fixes
11
CVEs
CRITICAL
Peak severity
28.2%
Coverage
Highlights
Auth Bypass: 170 prior fixes. Scrutinize any change in this area.
controllers/user.go: most-fixed (27 issues). Treat as high-risk during review.
173 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Insecure token signature validation and incorrect error handling during parsing allowed attackers to forge host tokens and masquerade as valid nodes, as tracked in CVE-2026-38651 and CVE-2022-0664. Fixes involved enforcing cryptographically secure key generation and proper signature verification.
Privilege Escalation: Lack of strict caller permission boundaries allowed standard administrators to promote themselves or others to SuperAdmin, and permitted normal users to change their own group associations during self-profile updates (CVE-2026-29195 and CVE-2023-32079).
Auth Bypass: Critical logical flaws in the network communication permission checks (IsUserAllowedToCommunicate) incorrectly returned true by default, failing to enforce actual ACL policy rules and allowing unauthorized inter-node communication.