The NetBird client daemon exposes its gRPC control interface to any local process with no authentication, in all versions from 0.5.0 (March 2022) to 0.75.1. On Linux, macOS and FreeBSD the interface is a Unix domain socket (/var/run/netbird.sock) with world-readable/writable permissions (0666). On Windows it is a loopback TCP listener (127.0.0.1:41731), where the transport carries no caller identity at all. Any unprivileged local user can connect and invoke all daemon RPCs without credentials.

An attacker with a low-privilege local account can exploit this to:

1. Read sensitive VPN configuration including management server URLs, WireGuard port, peer IP addresses, FQDNs, public keys, and SSH settings
2. Modify security-critical daemon configuration by enabling root SSH login, disabling SSH authentication, and disabling the firewall — all written to a root-owned config file
   (mode 0600)
3. Disconnect the VPN and unregister the peer from the victim's NetBird account
4. Re-register the peer to an attacker-controlled NetBird account using a setup key
5. Obtain a root shell via the built-in SSH server, which starts with no authentication when disableSSHAuth is set through the tampered config

Fix

Fixed in v0.76.0 (#6967). The daemon derives each local caller's identity from the kernel (SO_PEERCRED on Linux, LOCAL_PEERCRED on macOS and FreeBSD, the named-pipe client token on Windows) and requires root or administrator to enable the SSH server, enable SSH root login, disable SSH authentication, or to change the management URL or deregister the peer while that profile has the SSH server enabled. A caller whose identity cannot be established is refused. On Windows the daemon moved from loopback TCP to a named pipe, created in the ProtectedPrefix\Administrators namespace when it runs as a service, with clients verifying the pipe's owner.

Reading daemon status and configuration, and non-escalating operations such as disconnecting, remain available to local users and are not gated by this release.