CVE-2023-32079: Netmaker Privilege Escalation Vulnerability
Summary
CVE-2023-32079: Netmaker Vulnerable to Privilege Escalation From Non Admin To Admin User. Affects github.com/gravitl/netmaker across 2 version ranges.
< 0.17.1
>= 0.18.0, < 0.18.6
Fixed in 0.17.1 or 0.18.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Netmaker is an open-source networking tool written in Go. It provides a platform for managing and orchestrating virtual networks. The tool allows users to create, configure, and manage network nodes and connections. However, a vulnerability has been discovered in Netmaker that allows non-admin users to escalate their privileges to admin level.
Vulnerability Detail
The vulnerability in Netmaker is a mass assignment vulnerability that enables non-admin users to gain admin privileges. This means that an unauthorized user can perform actions that are typically restricted to administrators, potentially leading to unauthorized access, data manipulation, or system compromise. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Latest published version: v1.7.0 as of 23 Oct 2026
go get github.com/gravitl/netmaker@v1.7.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.17.10.17.1go get github.com/gravitl/netmaker@v0.17.1 -
>= 0.18.0, < 0.18.60.18.6go get github.com/gravitl/netmaker@v0.18.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If using Netmaker version 0.17.1, users can pull the latest Docker image of the backend and restart the server. This will help mitigate the vulnerability until a proper update can be applied.
Conclusion
The Netmaker Privilege Escalation vulnerability allows non-admin users to gain admin privileges, potentially leading to unauthorized access, data manipulation, or system compromise. To mitigate this vulnerability, users should update their Netmaker installation to version 0.18.6 or later. If using version 0.17.1, the provided workaround can be applied. Regularly updating Netmaker and following security best practices are essential for maintaining a secure environment.
See every vulnerability recorded for github.com/gravitl/netmaker →
FAQ
The vulnerability allows non-admin users to gain admin privileges, potentially leading to unauthorized access, data manipulation, or system compromise.
Update your Netmaker installation to version 0.18.6 or later. If using version 0.17.1, follow the provided workaround or run the mentioned commands to switch to the patched version.
There are no known exploits for this vulnerability at the moment. However, it is crucial to apply the recommended fixes to prevent any potential exploitation.
Yes, you can continue using Netmaker while applying the fix. Just make sure to follow the provided instructions to update or apply the workaround.
In addition to updating Netmaker, it is always recommended to follow security best practices, such as using strong passwords, implementing access controls, and regularly monitoring system logs for any suspicious activities.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/gravitl/netmaker.
