What this actually is.
Technical background, root cause, and affected surface.
In NetBird client netstack mode (NB_USE_NETSTACK_MODE=true), the SOCKS5 proxy that bridges local applications into the userspace WireGuard stack binds to 0.0.0.0 instead of loopback. The proxy has no authentication by design, so any host on the same network that can reach the proxy port (default 1080) can relay traffic through the client into its NetBird overlay without credentials.
- Vendor
- NetBird
- Product
- NetBird v0.74.3
- Severity
- Medium
- CVSS Score
- 5.4
- Status
- Fixed
- Vector
- CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L
- CWE
- CWE-1327: Binding to an Unrestricted IP Address
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
Start the client in netstack mode; from another host on the same network connect to the proxy port (default 1080) and issue a SOCKS5 CONNECT. Traffic is relayed into the victim's NetBird overlay with no credentials.
The bug, and the fix.
client/iface/netstack/env.go: func listenAddr(port int) string { return fmt.Sprintf("0.0.0.0:%d", port) } // binds to all interfaces; client/iface/netstack/proxy.go:24 socks5.NewServer(socks5.WithDial(...)) with no authenticator
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Any adjacent host can use the victim client as an unauthenticated SOCKS5 relay into its NetBird overlay, reaching peers and internal resources with the victim's network position.
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade to NetBird 0.74.7 or later. The SOCKS5 listener now binds to 127.0.0.1 by default; cross-host exposure requires explicit opt-in via NB_SOCKS5_LISTENER_ADDRESS.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Reported to NetBird via GitHub Security Advisory
Vendor accepted
Fix released in 0.74.7
Vendor reclassified as insecure default bind (CWE-1327)
Advisory published (GHSA-7wwh-vfq4-v488)
CVE-2026-105428 assigned
Disclosed 0 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.