Running or planning NetBird in production? We design, install and operate NetBird as a managed service - learn more at NetBird at WZ-IT and Network & Secure Access, or arrange a consultation directly.
NetBird is our preferred tool for secure, WireGuard-based network access following zero-trust principles: lean, open source and without classic VPN gateways. Recent releases brought several improvements - most visibly a much cleaner dashboard. This article summarizes the relevant changes (as of June 2026, NetBird v0.72) and what they mean for self-hosted operation.
Security notice: update to 0.76.0 or newer
Added 1 August 2026. On 29 July 2026, NetBird released version 0.76.0 to close a vulnerability in the client daemon (GHSA-qcpp-8vwj-hhwr, CVSS 8.8). Every version from 0.5.0 through 0.75.1 is affected - including the 0.72 described in this post.
The daemon exposed its gRPC interface without authentication: on Linux, macOS and FreeBSD through a Unix socket with 0666 permissions, on Windows through a loopback port. Any unprivileged local user could read the VPN configuration, enable SSH root login, disable SSH authentication and open a root shell through the built-in SSH server - which undermines exactly the identity-based SSH access this post describes. Disconnecting peers and re-registering them to attacker-controlled NetBird accounts was possible too.
0.76.0 verifies caller identity through the kernel and restricts privileged calls to root or administrators. The client has to be updated on every endpoint, not just on the management server. If you run NetBird through us, we have it covered - if you self-host and want a hand: let's talk.
Table of Contents
- The new NetBird dashboard
- NetBird SSH: identity-aware access
- Dual-stack IPv6 and MFA for local users
- Exposing private services over the network
- Self-hosting: updates and high availability, honestly
- Conclusion
The new NetBird dashboard
The most visible change is the redesigned web dashboard (Dashboard v2.39.0), rolled out on self-hosted v0.72 and in NetBird Cloud. The key step: the previously combined Peers list is now split into two views:
- User Devices - devices with real people behind them (laptops, phones).
- Servers - VMs, agents and other unattended machines.
That sounds small but changes a lot day to day: in networks that have grown over time, hundreds of server peers otherwise mix with employees' devices. The split makes access rules, monitoring and cleanup far clearer.
On top of that come a tidied-up sidebar, decluttered tables with better filters and a simplified layout that groups network routing more sensibly. Features that were hard to find now live where you would expect them.
Worth knowing: the dashboard is its own component with its own versioning (v2.x), while the core release (agent, management, signal, relay) follows the v0.72 line. When self-hosting, you update both.
NetBird SSH: identity-aware access
NetBird can secure SSH access directly over the mesh network - identity-aware and following zero-trust logic. Instead of distributing SSH keys across many servers, access is controlled via identity and groups; only those allowed by policy can connect.
This feature is not brand new but has matured: NetBird SSH was rebuilt from the ground up in v0.60.0 (with native OpenSSH support), and v0.61.0 added granular SSH access control plus automatic updates. The current v0.72 brings additional SSH and RDP fixes. For teams still managing SSH keys by hand, this is a strong argument: less key management, traceable access, clean offboarding.
Dual-stack IPv6 and MFA for local users
With v0.71.0 (May 2026), the overlay network became dual-stack: in addition to IPv4, accounts receive a configurable IPv6 prefix (default /64). An important step for modern, IPv6-friendly environments.
Also in v0.71.0: multi-factor authentication for local users, i.e. accounts not backed by an external identity provider. This lets you add protection even to a lean setup without a connected IdP.
Exposing private services over the network
v0.72.0 added the ability to make NetBird-internal services reachable only over the mesh - including a dashboard UI for "Bring Your Own Proxy". Internal services become reachable exclusively for authorized groups, without exposing them publicly to the internet.
We have already shown in detail how to make internal applications available cleanly behind NetBird: Expose internal services with NetBird and a reverse proxy.
Self-hosting: updates and high availability, honestly
Let's clear up a common misconception: self-hosted NetBird does not offer "active-active replication" as a free feature.
The default installation (the official getting-started script) puts all services on one server - management, signal and relay. That is simple, but it means a restart or failure of that server takes the service down. For more load, the installation can be split (e.g. signal on its own machine, the SQLite database moved to a dedicated PostgreSQL), which decouples the components. True high availability with multiple Management/Signal instances, however, is part of the commercial enterprise license, not the standard open-source variant.
For updates: the NetBird components are upgraded per the official upgrade docs (management, signal, relay, dashboard) - back up first, verify afterwards. If you run NetBird as a critical access layer, plan updates and a recovery concept from the start.
Our approach at WZ-IT
We run NetBird in production and as a managed service. In practice that means: a clean initial installation behind a reverse proxy, separated components and PostgreSQL where load requires it, hardened updates with backup and verification, and monitoring of the management, signal and relay services. This keeps access current and available without your team having to worry about upgrade paths or failure scenarios. If you want predictable costs, see our VPN flat rate with Managed NetBird from €349.90 net per month; the base package includes monitoring, updates, backups and support.
Further guides
- NetBird vs. Tailscale: the comparison - which zero-trust solution fits you.
- Tailscale alternative for enterprises - sovereign and self-hosted.
- Expose internal services with NetBird and a reverse proxy - a practical setup.
- Network & Secure Access at WZ-IT - our services around NetBird, WireGuard and Headscale.
Conclusion
NetBird matures with every release. The new dashboard with its split into User Devices and Servers makes day-to-day work in larger networks noticeably clearer, identity-aware SSH replaces tedious key management, and dual-stack IPv6 plus MFA for local users round out the picture.
For self-hosting, a sober look pays off: single-server is the default, true high availability is enterprise. If you use NetBird as a central access layer, plan for updates, backups and recovery from the start - or outsource operations.
Want to run, update or use NetBird as a managed service? We handle installation, operation and updates - GDPR-compliant and without vendor lock-in. Arrange a consultation now.
