netbirdio vulnerabilities

Products

• github.com/netbirdio/netbird 3

Latest netbirdio CVEs

Newest publication first

1. GHSA-rxmp-8h9v-56cx NetBird has Race Condition on UpdateUser Function, Resulting in Privilege Escalation From Admin to Owner

   Published 2026-04-01

   Medium·CVSS 4.4

   Summary A race condition vulnerability allows authenticated admin-privileged users to escalate to owner privilege. Details The vulnerability exists in the updateUser function, which is connected to the /users/{userId} PUT request. This function then calls the SaveOrAddUsers funct...

2. CVE-2025-10678 Admin with default credentials in NetBird VPN

   Published 2025-10-20

   Critical·CVSS 9.3 EPSS 0.42%

   NetBird VPN when installed using vendor's provided script failed to remove or change default password of an admin account created by ZITADEL. This issue affects instances installed using vendor's provided script. This issue may affect instances created with Docker if the default...

3. CVE-2024-41260 NetBird uses a static initialization vector (IV)

   Published 2024-08-01

   High·CVSS 7.5 EPSS 0.47%

   A static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information (email addresses) when in possession of the audit events database.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.