CVE-2022-23650: Hard-coded Cryptographic Key in Netmaker
Summary
CVE-2022-23650: Use of Hard-coded Cryptographic Key in Netmaker in github.com/gravitl/netmaker. Affects github.com/gravitl/netmaker across 2 version ranges.
< 0.8.5
>= 0.9.0, < 0.9.4
Fixed in 0.8.5 or 0.9.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Netmaker is a Go package developed by Gravitl. It provides networking and security functionalities for distributed systems. It allows users to create and manage virtual networks, enabling secure communication between different nodes. However, a vulnerability has been identified in Netmaker that involves the use of a hard-coded cryptographic key.
Vulnerability Detail
The vulnerability in Netmaker arises from the use of a hard-coded cryptographic key. This key is used for encryption and decryption operations within the package. By having a hard-coded key, an attacker could potentially obtain the key and decrypt sensitive information, compromising the security of the system. The vulnerability affects versions 0.0.0 to 0.8.4 and 0.9.0 to 0.9.3 of Netmaker.
How To Fix
Latest published version: v1.7.0 as of 23 Oct 2026
go get github.com/gravitl/netmaker@v1.7.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.8.50.8.5go get github.com/gravitl/netmaker@v0.8.5 -
>= 0.9.0, < 0.9.40.9.4go get github.com/gravitl/netmaker@v0.9.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by implementing additional security measures such as network segmentation, access controls, and monitoring for any suspicious activity.
Conclusion
The use of a hard-coded cryptographic key in Netmaker poses a significant security risk, as it allows attackers to potentially decrypt sensitive information. It is crucial for users to update to the fixed versions and avoid using hard-coded keys in the future. Implementing additional security measures can also help mitigate the risk.
See every vulnerability recorded for github.com/gravitl/netmaker →
FAQ
The vulnerability allows an attacker to potentially decrypt sensitive information by obtaining the hard-coded cryptographic key used in Netmaker.
Versions 0.0.0 to 0.8.4 and 0.9.0 to 0.9.3 of Netmaker are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file for analysis.
There are no known exploits for this vulnerability at the moment. However, it is important to patch the vulnerability as soon as possible to prevent any potential attacks.
Yes, the vulnerability has been fixed in versions 0.8.5 and 0.9.4 of Netmaker. It is recommended to update to the latest fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/gravitl/netmaker.
