VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/netbirdio/netbird: vulnerability history, versions and safety

github.com/netbirdio/netbird is a package in the Go ecosystem. Vulert records 6 vulnerabilities for it across 120 releases, from Aug 2024 to Jun 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
6 vulnerabilities recorded C1 H1 M1 U3
i
1 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
3 in the last 12 months

Most recent disclosure 25 Jun 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/netbirdio/netbird vulnerabilities

Vulert verdict on github.com/netbirdio/netbird v0.81.3 i

Updated on 23 Oct 2026

Careful: v0.81.3 has 5 known vulnerabilities, and 1 has no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 60/100
  • Security Some issues to review
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Moderate

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v0.81.3 — affected i
  • Vulnerabilities on record 6 over 1 year · 3 in the last year i
  • Latest disclosure 25 Jun 2026 i
  • Highest CVSS 9.3 i
  • With no published fix 1 i
  • Stars 30,017 i
  • OpenSSF scorecard 6/10 i
  • Last release this month i
  • Licence BSD-3-Clause i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/netbirdio/netbird, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.81.2-0.20261022205747-8397bed4afff 22 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.2-0.20261022123252-0fc596e2e1a8 22 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.2-0.20261022083922-abf50e3ad4bd 22 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.2-0.20261021184001-0e16209e053f 21 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20261021183748-b03d1c7d0794 21 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.2-0.20261021183748-b03d1c7d0794 21 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.2-0.20261021174633-73829c8d968b 21 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.2-0.20261021144749-4c8599d68ec8 21 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.2-0.20261021142409-56223b59605a 21 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.2-0.20261021135305-031a4bd70de4 21 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-canary.pr-7407.2 21 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20261020155032-aa0f569677a6 20 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.2-0.20261020155032-aa0f569677a6 20 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.2-0.20261020122105-569b9aa169c0 20 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20261019201939-8fef487e4256 19 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.2-0.20261019201939-8fef487e4256 19 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.2-0.20261019164901-ea8fea57b0d9 19 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20261019164725-36fe467aba42 19 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.2-0.20261019164725-36fe467aba42 19 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20261019143917-0bb985470429 19 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.2-0.20261019143917-0bb985470429 19 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.3 19 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20261019131659-b1f4efb16007 19 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.2-0.20261019131659-b1f4efb16007 19 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20261019120815-f8f335720de0 19 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.2-0.20261019120815-f8f335720de0 19 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20261019115814-279adb8fdd5c 19 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20261016185243-cf0171197111 16 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.2-0.20261016185243-cf0171197111 16 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.2 16 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20261016001645-28657607c14d 16 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.1 16 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-rc.1.0.20261015142736-afd5c6df6a26 15 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-rc.1.0.20261015122650-357d8a2a7c56 15 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0 15 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-rc.3.0.20261015120807-c0f090448c14 15 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-rc.1.0.20261015101957-547dd1f177bc 15 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-canary.pr-8192.1 14 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-rc.3 14 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-rc.1.0.20261014135016-405bbb8997f3 14 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20261013164627-9efe59b9b2b2 13 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-rc.1.0.20261013164627-9efe59b9b2b2 13 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-rc.1.0.20261013141325-f62949605e2b 13 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-rc.2 13 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-rc.1.0.20261013100410-49ec0e26999a 13 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20261012183604-a39495816007 12 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-rc.1.0.20261012183604-a39495816007 12 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20261012141303-8c70f9ec71e2 12 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-canary.pr-8098.1.0.20261012141303-8c70f9ec71e2 12 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-rc.1 12 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-canary.pr-8098.1.0.20261012100909-a7a2575bad46 12 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-canary.pr-8098.1.0.20261012092837-5c9c64e3e012 12 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20261009144017-67c2041fb553 09 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-canary.pr-8098.1.0.20261009144017-67c2041fb553 09 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20261009134218-f0a40e439548 09 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-canary.pr-8098.1.0.20261009134218-f0a40e439548 09 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20261009125700-53a14551c8db 09 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-canary.pr-8098.1.0.20261009113725-a5834fdaab96 09 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20261008142856-01d828d732e3 08 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-canary.pr-8098.1.0.20261008142856-01d828d732e3 08 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20261008141723-06c4c200108b 08 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-canary.pr-8098.1.0.20261008141723-06c4c200108b 08 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20261008134039-515a01dd1179 08 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20261008130412-834b0f699c8d 08 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20261008105509-cc51a3e16aa2 08 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-canary.pr-8098.1.0.20261008105509-cc51a3e16aa2 08 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-canary.pr-8098.1.0.20261008093637-e392c5899e6b 08 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20261007170731-24cb7b75c2e1 07 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-canary.pr-8098.1.0.20261007170731-24cb7b75c2e1 07 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-canary.pr-8098.1 07 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-canary.pr-7890.1 06 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-canary.pr-7395.1.0.20261006171044-e2a2d379c5c3 06 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-canary.pr-7395.1 06 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-canary.pr-7407.1 06 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.80.0-rc.1.0.20261005230436-d6340ba0de1d 05 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20261005144848-eb5a98c05989 05 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20261005143143-2b5293687f3e 05 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.80.0-rc.1.0.20261005143143-2b5293687f3e 05 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20261005135931-f175e402c7d2 05 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20261005133706-ad03081e1fb8 05 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.80.0-rc.1.0.20261005133248-bc44cdc37a3b 05 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20261005131108-6b3cfbabd2d6 05 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20261002205336-88b26bb74f50 02 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.80.0-rc.1.0.20261002205336-88b26bb74f50 02 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.80.0-rc.1.0.20261002170300-3c4358dd3625 02 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20261002132439-9f8ddc71315b 02 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.80.0-rc.1.0.20261002132439-9f8ddc71315b 02 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.80.0-rc.1.0.20261001190156-5ceca6e500fb 01 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.80.0 01 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.80.0-rc.1.0.20261001130110-6425b042002f 01 Oct 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20260930162538-fd1a0203c7d9 30 Sep 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.80.0-rc.1.0.20260930162538-fd1a0203c7d9 30 Sep 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.80.0-rc.2 30 Sep 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.80.0-rc.1.0.20260930093518-39de33ceca93 30 Sep 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.0.0-20260928224555-782c9434106f 28 Sep 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.80.0-rc.1.0.20260928224555-782c9434106f 28 Sep 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.80.0-rc.1.0.20260928160342-164d92e78da0 28 Sep 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.80.0-rc.1 28 Sep 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.79.0-rc.1.0.20260925171535-d5488db146bf 25 Sep 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.81.0-canary.pr-7662.1 24 Sep 2026 C1 M1 U3 BSD-3-Clause No Details →
v0.79.0-rc.1.0.20260923194748-6e17f50040dc 23 Sep 2026 C1 M1 U3 — No Details →
v0.0.0-20260921152652-ee2344502eaa 21 Sep 2026 C1 M1 U3 — No Details →
v0.79.0-rc.1.0.20260921152652-ee2344502eaa 21 Sep 2026 C1 M1 U3 — No Details →
v0.79.0-rc.1.0.20260920182401-3073d18039a0 20 Sep 2026 C1 M1 U3 — No Details →
v0.79.0 18 Sep 2026 C1 M1 U3 — No Details →
v0.0.0-20260918152134-7d8f4fa31c2c 18 Sep 2026 C1 M1 U3 — No Details →
v0.79.0-rc.1.0.20260918152134-7d8f4fa31c2c 18 Sep 2026 C1 M1 U3 — No Details →
v0.0.0-20260917094503-f8c3e565f3f7 17 Sep 2026 C1 M1 U3 — No Details →
v0.79.0-rc.1.0.20260917094503-f8c3e565f3f7 17 Sep 2026 C1 M1 U3 — No Details →
v0.78.1-0.20260915100557-e70ec07320d6 15 Sep 2026 C1 M1 U3 — No Details →
v0.0.0-20260914202025-ea294e1d46c2 14 Sep 2026 C1 M1 U3 — No Details →
v0.78.1-0.20260914202025-ea294e1d46c2 14 Sep 2026 C1 M1 U3 — No Details →
v0.78.1-0.20260914190853-8b1827dcf4fb 14 Sep 2026 C1 M1 U3 — No Details →
v0.0.0-20260914174202-ea216f8e7323 14 Sep 2026 C1 M1 U3 — No Details →
v0.78.1-0.20260914174202-ea216f8e7323 14 Sep 2026 C1 M1 U3 — No Details →
v0.78.2 14 Sep 2026 C1 M1 U3 — No Details →
v0.0.0-20260914152801-a54d96cd72b4 14 Sep 2026 C1 M1 U3 — No Details →
v0.78.1-0.20260914152801-a54d96cd72b4 14 Sep 2026 C1 M1 U3 — No Details →
v0.79.0-rc.1 14 Sep 2026 C1 M1 U3 — No Details →
v0.80.0-canary.pr-7535.1 14 Sep 2026 C1 M1 U3 — No Details →

The newest 120 of 937 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2024 2
  • 2025 2
  • 2026 2

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 3 of the 6 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/netbirdio/netbird

The 5 most severe of 6 vulnerabilities recorded for this package

Search all 6 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2025-10678: NetBird VPN Fails to Remove Default Admin Password 9.3 critical 0.57.0 20 Oct 2025
Static Initialization Vector (IV) in NetBird 7.5 high 0.29.2 01 Aug 2024
Privilege Escalation Vulnerability in NetBird Package: Race Condition in UpdateUser Function 4.4 medium 0.65.3 01 Apr 2026
CVE-2024-41260: Static Initialization Vector (IV) in NetBird N/A unrated No fix published 13 Aug 2024
CVE-2025-10678: NetBird VPN Admin Account Default Password Vulnerability N/A unrated 0.57.0 30 Oct 2025

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/netbirdio/netbird

Is github.com/netbirdio/netbird safe to use?

Vulert records 6 vulnerabilities for github.com/netbirdio/netbird in Go: 1 critical, 1 high, 1 medium and 0 low, plus 3 not yet rated. 1 of them has no published fix yet, so that is the one to avoid or mitigate.

What is github.com/netbirdio/netbird's Vulert package health score?

Vulert scores github.com/netbirdio/netbird 60/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of github.com/netbirdio/netbird affected?

Yes. v0.81.3, the version you would install today, has 5 known vulnerabilities, and 1 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

How many vulnerabilities does github.com/netbirdio/netbird have?

6 vulnerabilities are recorded for github.com/netbirdio/netbird in the Go ecosystem: 1 critical, 1 high, 1 medium and 0 low, plus 3 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/netbirdio/netbird vulnerabilities disclosed?

3 vulnerabilities were recorded for github.com/netbirdio/netbird in the last 12 months, and the oldest entry in this database dates to 01 Aug 2024. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/netbirdio/netbird are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/netbirdio/netbird for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/netbirdio/netbird version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.