CVE-2023-32077
HighNetmaker has Hardcoded DNS Secret Key
Published Aug 25, 2023 · Updated Aug 12, 2026 · Also known as GHSA-8x8h-hcq8-jwwx, GO-2023-2022
Key Facts
Patch in the next maintenance window- CVE-2023-32077 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Netmaker, github.com/gravitl/netmaker (go).
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 3.5% probability of exploitation in the next 30 days.
- Fixed versions are available, including github.com/gravitl/netmaker 0.17.1, github.com/gravitl/netmaker 0.18.6, Netmaker 0.17.1.
- Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS (30-day exploit likelihood)
3.5%
Higher than 89.0% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2023-32077 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints. The issue is patched in 0.17.1 and fixed in 0.18.6. If users are using 0.17.1, they should run docker pull gravitl/netmaker:v0.17.1 and docker-compose up -d. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone who is using version 0.17.1 can pull the latest docker image of the backend and restart the server.
Affected Products
3 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| NetmakerNetmaker | >= < 0.17.1 | 0.17.1 |
| github.com/gravitl/netmakergo | See advisory | 0.17.1 |
Patched Releases
github.com/gravitl/netmaker
0.17.1, 0.18.6
Netmaker
0.17.1
Timeline
Publicly disclosed
Aug 25, 2023
Last updated
Aug 12, 2026
Weakness Type
- CWE-321 Use of Hard-coded Cryptographic Key
- CWE-798 Use of Hard-coded Credentials
References
- advisoryGHSA advisory
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32077.json
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2023-32077
- articlehttps://github.com/gravitl/netmaker/commit/1621c27c1d176b639e9768b2acad7693e387fd51
- articlehttps://github.com/gravitl/netmaker/commit/9362c39a9a822f0e07361aa7c77af2610597e657
FAQ
Common Questions.
Netmaker makes networks with WireGuard.
Affected: Netmaker versions >= < 0.17.1; github.com/gravitl/netmaker (go). The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including github.com/gravitl/netmaker 0.17.1, github.com/gravitl/netmaker 0.18.6, Netmaker 0.17.1.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
Is CVE-2023-32077 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo