CVE-2022-23650: Hard-coded Cryptographic Key in Netmaker
Summary
CVE-2022-23650: Use of Hard-coded Cryptographic Key in Netmaker. Affects github.com/gravitl/netmaker across 2 version ranges.
< 0.8.5
>= 0.9.0, < 0.9.4
Fixed in 0.8.5 or 0.9.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Netmaker is an open-source project written in Go that provides a server component for managing network connections. It allows administrators to control and configure network settings. The vulnerability in Netmaker arises from the presence of a hard-coded cryptographic key in the codebase. This key can be exploited by an attacker who knows the address and username of the admin, enabling them to execute admin commands on a remote server. It is important to note that this vulnerability only affects the server component (netmaker) and not the clients.
Vulnerability Detail
The presence of a hard-coded cryptographic key in Netmaker poses a significant security risk. An attacker with knowledge of the admin's address and username can leverage this key to run admin commands on a remote server. This could lead to unauthorized access, data breaches, and potential compromise of the entire network infrastructure. The vulnerability has a CVSS score of 7.2, indicating a high severity level.
How To Fix
Latest published version: v1.7.0 as of 23 Oct 2026
go get github.com/gravitl/netmaker@v1.7.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.8.50.8.5go get github.com/gravitl/netmaker@v0.8.5 -
>= 0.9.0, < 0.9.40.9.4go get github.com/gravitl/netmaker@v0.9.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The presence of a hard-coded cryptographic key in Netmaker poses a significant security risk, allowing attackers to run admin commands on a remote server. To mitigate this vulnerability, it is crucial to upgrade to one of the patched versions of Netmaker. If you have any further questions or need assistance with vulnerability remediation, you can reach out to the Netmaker team at info@gravitl.com.
See every vulnerability recorded for github.com/gravitl/netmaker →
FAQ
Netmaker is an open-source project written in Go that provides a server component for managing network connections. It allows administrators to control and configure network settings.
The vulnerability allows an attacker with knowledge of the admin's address and username to run admin commands on a remote server. This could lead to unauthorized access, data breaches, and potential compromise of the entire network infrastructure.
This vulnerability affects the server component (netmaker) of Netmaker. The clients are not impacted.
To fix this vulnerability, it is recommended to upgrade to one of the patched versions of Netmaker. Follow the steps provided in the 'how_to_fix' section of this report.
No specific workaround is mentioned for this vulnerability. It is advised to upgrade to the patched versions of Netmaker.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/gravitl/netmaker.
