TI-2022-07702 Aliases CVE-2022-23650 GHSA-86f3-hf24-76q4

Use of Hard-coded Cryptographic Key in Netmaker

MEDIUM 43CWE-321Published 2022-02-18 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-321.

Summary

Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and username of the admin. This effects the server (netmaker) component, and not clients. This has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. There are currently no known workarounds.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01587 75th percentileScored 2026-11-07

Fix Fixed netmaker (gravitl): 0.8.5, 0.9.4github.com/gravitl/netmaker (Go): 0.8.5, 0.9.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
gravitl	netmaker	before 0.8.5; 0.9.0 to before 0.9.4	0.8.5, 0.9.4	Patch available	CNA
—	github.com/gravitl/netmaker (Go)	before 0.8.5	0.8.5	Patch available	GHSA-86f3-hf24-76q4
—	github.com/gravitl/netmaker (Go)	0.9.0 to before 0.9.4	0.9.4	Patch available	GHSA-86f3-hf24-76q4

netmaker Vendorgravitl Affected before 0.8.5; 0.9.0 to before 0.9.4 Fixed in 0.8.5, 0.9.4 Patch available CNA
github.com/gravitl/netmaker (Go) Vendor— Affected before 0.8.5 Fixed in 0.8.5 Patch available GHSA-86f3-hf24-76q4
github.com/gravitl/netmaker (Go) Vendor— Affected 0.9.0 to before 0.9.4 Fixed in 0.9.4 Patch available GHSA-86f3-hf24-76q4

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:netmaker:netmaker::::::::	before 0.8.5; 0.9.0 to before 0.9.4	Vulnerable	Netmaker

cpe:2.3:a:netmaker:netmaker:*:*:*:*:*:*:*:* Versions before 0.8.5; 0.9.0 to before 0.9.4 Vulnerable ·Netmaker

Remediation

Fix · CNA netmaker (gravitl) Fixed in 0.8.5, 0.9.4
Fix · GHSA-86f3-hf24-76q4 github.com/gravitl/netmaker (Go) Fixed in 0.8.5 Advisory →
Fix · GHSA-86f3-hf24-76q4 github.com/gravitl/netmaker (Go) Fixed in 0.9.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-23650
2026-10-03 Alias added: GHSA-86f3-hf24-76q4

References

Patch 3

Advisory 2

Other 1

https://github.com/gravitl/netmaker

TI-2026-56044 Netmaker through 1.6.0 Improper Certificate Validation in SMTP Client CVSS 4.0HIGH 8.3
TI-2022-00579 Use of Hard-coded Cryptographic Key in gravitl/netmaker CVSS 3.1CRITICAL 9.8
TI-2023-15381 Netmaker has Hardcoded DNS Secret Key CVSS 3.1HIGH 7.5
TI-2026-23357 Netmaker: Denial of Service via Server Shutdown Endpoint CVSS 4.0HIGH 8.7
TI-2026-23313 Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys CVSS 4.0HIGH 8.7
TI-2023-15383 Netmaker Privilige Escalation Vulnerability CVSS 3.1HIGH 8.8

See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences