gravitl/netmaker · Security
Netmaker Vulnerable to Denial of Service via Server Shutdown Endpoint
- GHSA ID
- GHSA-rhr9-hgcm-x289
- CVE ID
- CVE-2026-29771
- Severity
- high
- Published
- Updated
- CVSS v4
- 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Description
The /api/server/shutdown endpoint allows termination of the Netmaker server process via syscall.SIGINT. This allows any user to repeatedly shut down the server, causing cyclic denial of service with approximately 3-second restart intervals.
CWEs
- CWE-404 · Improper Resource Shutdown or Release