CVE-2026-44343 is a critical flaw (CVSS 9.8) in WGDashboard, a web dashboard for WireGuard VPN, before version 4.3.2. The maintainers say unauthorized parties could access the host file system without logging in. Update to 4.3.2 and keep the dashboard off public networks.
What's affected
From the project advisory:
- Affected: versions before 4.3.2.
- Fixed: 4.3.2 and later.
The maintainers say the advisory applies to anyone running WGDashboard on a publicly accessible network. They say users who run it only inside a private or local network are not believed to be at risk, but they still recommend updating. They also said further technical detail would be shared on their community server, so the public advisory is short.
How to check if you're exposed
Check the version in the dashboard interface footer or settings, or in the install directory of a source install:
git -C /path/to/WGDashboard describe --tags
Docker users can read the image tag:
docker ps --format '{{.Image}} {{.Names}}' | grep -i wgdashboard
Then check whether the dashboard port is reachable from the internet, for example from a host outside your network.
What to do now
- Update WGDashboard to 4.3.2 or later.
- If you cannot update now, host it on an internal network that only you and trusted parties can reach. This is the maintainers workaround.
- Put the dashboard behind a VPN or an allow list instead of exposing the port.
- Because a dashboard like this may hold VPN keys, review the host for unexpected changes and consider rotating keys if it was exposed.
Why it matters
The record lists CWE-20 (improper input validation). The public advisory gives little detail beyond the impact, which is access to the host file system without authentication. Files on a VPN management host can include private keys and configuration for every peer.
The pattern is common for admin dashboards. They are built for a trusted network, then published to the internet for convenience. The record does not mark this CVE as KEV.
Quick check
Am I safe if the dashboard is only on my LAN?
The maintainers say private deployments are not believed to be at risk, but they still recommend updating.
Sources
Last reviewed: 19 October 2026.
