CVE-2023-32077 json
Netmaker has Hardcoded DNS Secret Key
published 2023-08-24 3 y ago modified 2026-06-17 4 mo ago also GHSA-8x8h-hcq8-jwwx , GO-2023-2022 , EUVD-2023-2249
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.5%
- EPSS 3.5% chance of exploitation in 30 days, percentile 89%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints. The issue is patched in 0.17.1 and fixed in 0.18.6. If users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone who is using version 0.17.1 can pull the latest docker image of the backend and restart the server.
Patch / fix
- go github.com/gravitl/netmaker 0.17.1, 0.18.6
- netmaker netmaker 0.17.1
- github.com/gravitl/netmaker@1621c27 commit
- github.com/gravitl/netmaker@9362c39 commit
- github.com/gravitl/netmaker#2170 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
3.53% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template Netmaker - Hardcoded DNS Secret Key nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/gravitl/netmaker | <0.17.1 >=0.18.0, <0.18.6 |
0.17.1 0.18.6 |
Affected products
- gravitl netmaker
Classification
References
-
github.com
/gravitl/netmaker/pull/2170
web, patch
-
github.com
/gravitl/netmaker/commit/1621c27c1d176b639e9768b2acad7693e387fd51
web, patch
-
github.com
/gravitl/netmaker/commit/9362c39a9a822f0e07361aa7c77af2610597e657
web, patch
-
github.com
/gravitl/netmaker/security/advisories/GHSA-8x8h-hcq8-jwwx
web, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-32077
advisory
-
github.com
/gravitl/netmaker
package
Sources
- CVE List CVE-2023-32077
- GitHub Advisory GHSA-8x8h-hcq8-jwwx
- NVD CVE-2023-32077
- OSV GO-2023-2022
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.