CVE-2026-32599

Name of the Vulnerable Software and Affected Versions Netmaker versions prior to 1.5.0

Description An authenticated attacker can perform boolean-based SQL injection when the SQLite database backend is used. The issue occurs because the sqliteDeleteRecord() function in the database layer constructs SQL DELETE statements using direct string concatenation of user-supplied input instead of parameterization. This can be exploited via the '/api/dns/{network}/{domain}' endpoint, where the {domain} path parameter is passed through logic.DeleteDNS and database.DeleteRecord to the vulnerable function. By injecting SQL operators into the {domain} variable, an attacker can infer sensitive information such as table names, column names, and values by observing whether a DNS record is deleted or remains. PostgreSQL is not affected as it uses parameterized queries.

Recommendations Update to version 1.5.0. As a temporary workaround, restrict access to the '/api/dns/{network}/{domain}' endpoint to minimize the risk of exploitation.