CVE-2024-41260 json
NetBird uses a static initialization vector (IV)
published 2024-08-01 2 y ago modified 2026-06-17 4 mo ago also GHSA-9v35-4xcr-w9ph , GO-2024-3057 , EUVD-2024-2551
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 41%
- public exploits
- 0
- none known
Summary
A static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information (email addresses) when in possession of the audit events database.
Patch / fix
- go github.com/netbirdio/netbird 0.29.2
- govulncheck-vulndb openSUSE Leap 15.6 0.0.20251230T014957-150000.1.134.1
suse advisories SUSE-SU-2026:0037-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
opensuse advisories openSUSE-SU-2026:21483-1
- github.com/netbirdio/netbird@cf6210a commit
- github.com/netbirdio/netbird#2569 pull request
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.47% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/netbirdio/netbird | >=0.23.2, <0.29.2 |
0.29.2 |
Affected products
- netbirdio netbird
Classification
- Weakness
-
- CWE-321 Use of Hard-coded Cryptographic Key
References
-
github.com
/netbirdio/netbird/pull/2569
web, patch
-
github.com
/netbirdio/netbird/commit/cf6210a6f42355e88c422c624376f6fcdaea6729
web, patch
-
gist.github.com
/nyxfqq/92232108ac153e95d538bb17fc5ad636
web
-
github.com
/github/advisory-database/pull/5714
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-41260
advisory
-
github.com
/netbirdio/netbird/issues/2246
web, report
-
github.com
/advisories/GHSA-9v35-4xcr-w9ph
advisory
-
github.com
/netbirdio/netbird
package
Sources
- CVE List CVE-2024-41260
- GitHub Advisory GHSA-9v35-4xcr-w9ph
- NVD CVE-2024-41260
- OSV GO-2024-3057
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.