Read the docs
TI-2023-15381 Aliases CVE-2023-32077GHSA-8x8h-hcq8-jwwx

Netmaker has Hardcoded DNS Secret Key

Priority MEDIUM 45CWE-321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-321.

Summary

Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints. The issue is patched in 0.17.1 and fixed in 0.18.6. If users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone who is using version 0.17.1 can pull the latest docker image of the backend and restart the server.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03534 89th percentileScored 2026-11-07
Fix Fixed netmaker (gravitl): 0.17.1, 0.18.6github.com/gravitl/netmaker (Go): 0.17.1, 0.18.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gravitlnetmakerbefore 0.17.1; 0.18.0 to before 0.18.60.17.1, 0.18.6Patch availableCNA
—github.com/gravitl/netmaker (Go)before 0.17.10.17.1Patch availableGHSA-8x8h-hcq8-jwwx
—github.com/gravitl/netmaker (Go)0.18.0 to before 0.18.60.18.6Patch availableGHSA-8x8h-hcq8-jwwx
  • netmaker Vendorgravitl Affected before 0.17.1; 0.18.0 to before 0.18.6 Fixed in 0.17.1, 0.18.6 Patch available CNA
  • github.com/gravitl/netmaker (Go) Vendor— Affected before 0.17.1 Fixed in 0.17.1 Patch available GHSA-8x8h-hcq8-jwwx
  • github.com/gravitl/netmaker (Go) Vendor— Affected 0.18.0 to before 0.18.6 Fixed in 0.18.6 Patch available GHSA-8x8h-hcq8-jwwx

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:netmaker:netmaker:*:*:*:*:*:*:*:*before 0.17.1; 0.18.0 – 0.18.5VulnerableNetmaker
  • cpe:2.3:a:netmaker:netmaker:*:*:*:*:*:*:*:* Versions before 0.17.1; 0.18.0 – 0.18.5 Vulnerable ·Netmaker

Remediation

  • Fix · CNA netmaker (gravitl) Fixed in 0.17.1, 0.18.6
  • Fix · GHSA-8x8h-hcq8-jwwx github.com/gravitl/netmaker (Go) Fixed in 0.17.1 Advisory →
  • Fix · GHSA-8x8h-hcq8-jwwx github.com/gravitl/netmaker (Go) Fixed in 0.18.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-32077
  2. 2026-10-03 Alias added: GHSA-8x8h-hcq8-jwwx

References

Patch 3

Advisory 2

Other 1

  • TI-2026-56044 Netmaker through 1.6.0 Improper Certificate Validation in SMTP Client CVSS 4.0HIGH 8.3
  • TI-2022-00579 Use of Hard-coded Cryptographic Key in gravitl/netmaker CVSS 3.1CRITICAL 9.8
  • TI-2026-23357 Netmaker: Denial of Service via Server Shutdown Endpoint CVSS 4.0HIGH 8.7
  • TI-2026-23313 Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys CVSS 4.0HIGH 8.7
  • TI-2022-07702 Use of Hard-coded Cryptographic Key in Netmaker CVSS 3.1HIGH 8.8
  • TI-2023-15383 Netmaker Privilige Escalation Vulnerability CVSS 3.1HIGH 8.8
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences