NetBird VPN default admin credentials enable unauthorized access
NetBird VPN installations via vendor script left ZITADEL admin account with default password, enabling unauthorized administrative access; fixed in v0.57.0.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of CVE-2025-10678 affecting NetBird VPN software. The vulnerability stems from the vendor-provided installation script failing to remove or change the default administrative password for an account created by ZITADEL, NetBird's default identity provider. This configuration flaw allows attackers with knowledge of the default credentials to gain unauthorized administrative access to affected NetBird VPN instances.
The issue impacts installations performed using the vendor's official script and may also affect Docker-based deployments where administrators did not manually change the default password or remove the default admin user. The vulnerability was responsibly disclosed by security researcher Adam Sobieraj and has been remediated in NetBird version 0.57.0.
Organizations running NetBird VPN should immediately upgrade to version 0.57.0 or later and verify that default administrative accounts have been removed or secured with strong, unique credentials. The vulnerability represents a significant authentication bypass risk for affected installations.
Mentioned in this report
Detection guidance
NetBird Vendor Install Script Execution Leaving Default ZITADEL Admin Credential
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects execution of the official NetBird installation script that provisions ZITADEL without any subsequent password rotation step, indicating a host is likely vulnerable to CVE-2025-10678. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: NetBird Official Install Script Execution (Potential Default Admin Exposure)
id: e3dc04e7-6722-548e-b83e-8e267117ed6f
status: experimental
description: 'Detects execution of the NetBird vendor-provided installation script
(getting-started / install.sh style invocation) that provisions a bundled ZITADEL
identity provider. Versions of this script prior to the fix for CVE-2025-10678 do
not remove or rotate the default ZITADEL admin account password, leaving newly installed
NetBird management servers with a default administrative credential. This rule flags
the install action itself so defenders can follow up with credential rotation.
'
references:
- CVE-2025-10678
author: Vorant
tags:
- attack.t1078.001
logsource:
category: process_creation
product: linux
detection:
selection:
CommandLine|contains|all:
- netbird
- install.sh
condition: selection
falsepositives:
- Legitimate first-time deployment of NetBird by an administrator who will manually
rotate the ZITADEL admin password afterward
- Configuration management tooling (Ansible/Terraform) invoking the same install script
as part of approved infrastructure provisioning
level: low
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2025/10/CVE-2025-10678
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,566 reports from 147 sources, 722 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs