NetBird: 12,226 title matches, 3 application matches, 1,234 certificate hits

NetBird, an open-source overlay network solution, was observed in various ways on October 23, 2026. The network was detected through 12,226 title matches, 3 application matches, and 1,234 certificate hits. A title match indicates the product's presence through its web dashboard interface, while an application match refers to the API component. Certificate hits suggest the presence of NetBird's self-signed certificate in TLS handshakes.

The large ratio of title matches to application matches suggests that the self-hosted NetBird deployment is primarily accessed through its web interface. This is because the dashboard presents a title and a TLS certificate, making it the most exposed part of the system. The API, which handles peer authentication and configuration distribution, is often exposed alongside the dashboard, either on the same hostname or a separate port.

The certificate count of 1,234 is a unique indicator of NetBird's presence, as it is not a subset of the title count. This certificate disclosure reveals the product name, allowing anyone to confirm the network's presence. However, it is not a vulnerability but rather a naming decision that helps others identify the network.

The management dashboard, exposed to humans, is the most likely component to be published through a reverse proxy on port 443. The control plane, responsible for peer registration, access policies, and member authentication, is the asset to watch. An unauthorized party gaining access to this service can join the mesh, potentially exploiting the flat network topology designed for efficiency.

For operators, the key questions revolve around the accessibility of the three components - the dashboard, API, and enrolment endpoint. They must assess whether external access is restricted, if the dashboard requires identity provider authentication, and if the enrolment endpoint is secured. Additionally, they should verify whether certificates are issued with names that accurately represent the organization, rather than the software itself.

Overall, the detection of NetBird is based on various signals, including peer enrolment and dashboard authentication events. Monitoring these events can help confirm the network's presence and ensure its secure operation.