CVE-2022-36110: Insufficient Granularity of Access Control in Netmaker
Summary
CVE-2022-36110: Netmaker vulnerable to Insufficient Granularity of Access Control in github.com/gravitl/netmaker. Affects github.com/gravitl/netmaker versions < 0.15.1. Fixed in 0.15.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Netmaker is an open-source project written in Go that provides a networking tool for creating and managing virtual networks. It allows users to connect multiple devices and securely communicate over the internet. The vulnerability identified in Netmaker is related to insufficient granularity of access control, which can lead to unauthorized access and potential data breaches.
Vulnerability Detail
The vulnerability in Netmaker arises from a lack of proper access control mechanisms. This means that certain actions or resources within the application may not have appropriate restrictions on who can access them. Attackers could exploit this vulnerability to gain unauthorized access to sensitive information, manipulate network configurations, or perform other malicious activities. The vulnerability has been assigned the identifier CVE-2022-36110 and has been flagged as a high-severity issue.
How To Fix
Latest published version: v1.7.0 as of 23 Oct 2026
go get github.com/gravitl/netmaker@v1.7.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.15.1
This is the first release that contains the fix.
go get github.com/gravitl/netmaker@v0.15.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement additional access control measures at the network level, such as firewall rules or network segmentation, to limit the potential impact of unauthorized access. However, this is not a permanent solution, and updating to the latest version of Netmaker is strongly recommended.
Conclusion
The vulnerability in Netmaker, identified as CVE-2022-36110, exposes the application to unauthorized access and potential data breaches. It is crucial for users to update their Netmaker installations to version 0.15.1 or later to mitigate this vulnerability. Implementing additional access control measures at the network level can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for github.com/gravitl/netmaker →
FAQ
The vulnerability in Netmaker can lead to unauthorized access to sensitive information and potential data breaches. Attackers could manipulate network configurations, gain control over network devices, or perform other malicious activities.
You can use Vulert's playground at Vulert Scanner to check if your Netmaker installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the Gopkg.lock file.
Yes, the developers of Netmaker have released a patch in version 0.15.1. It is recommended to update your Netmaker installation to the latest version to address the vulnerability.
As a temporary workaround, you can implement additional access control measures at the network level, such as firewall rules or network segmentation, to limit the potential impact of unauthorized access. However, updating to the latest version of Netmaker is the recommended solution.
You can find more information about this vulnerability in the CVE-2022-36110 entry on the National Vulnerability Database (NVD) website.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/gravitl/netmaker.
