GoPackage

github.com/gravitl/netmaker

12 known vulnerabilities (10 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release: v1.7.0 (Aug 31, 2026): no advisory affects it
Newest unaffected release: v1.7.0 (Aug 31, 2026), the latest release
Advisories: 12 · 10 high, 2 medium

Releases: 78 since v0.5.5 (Jul 11, 2021)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-32599
Affects v0.5.5 to v1.4.0 (v1.5.0 is outside it)
CVE-2026-38651
Affects v0.5.5 to v1.4.0 (v1.5.0 is outside it)
CVE-2026-29196
Affects v0.5.5 to v1.4.0 (v1.5.0 is outside it)
CVE-2026-29195
Affects v0.5.5 to v1.4.0 (v1.5.0 is outside it)
CVE-2026-29194
Affects v0.5.5 to v1.4.0 (v1.5.0 is outside it)
CVE-2026-29771
Affects v0.5.5 to v1.1.0 (v1.2.0 is outside it)
CVE-2023-32079
Affects v0.5.5 to v0.17.0 (v0.17.1 is outside it); v0.18.0 to v0.18.4 (v0.18.6 is outside it)
CVE-2023-32078
Affects v0.5.5 to v0.17.0 (v0.17.1 is outside it); v0.18.0 to v0.18.4 (v0.18.6 is outside it)
CVE-2023-32077
Affects v0.5.5 to v0.17.0 (v0.17.1 is outside it); v0.18.0 to v0.18.4 (v0.18.6 is outside it)
CVE-2022-36110
Affects v0.5.5 to v0.15.0 (v0.15.1 is outside it)
CVE-2022-23650
Affects v0.5.5 to v0.8.4 (v0.8.5 is outside it); v0.9.0 to v0.9.3 (v0.9.4 is outside it)
CVE-2022-0664
Affects v0.5.5 to v0.8.4 (v0.8.5 is outside it); v0.9.0 to v0.9.3 (v0.9.4 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 12

CVE-2026-32599Medium 5.3
Netmaker has a boolean‑based SQL Injection
Affected: fixed in 1.5.0.
Fixed in v1.5.0 (released Feb 11, 2026, 216 days before disclosure).
The latest release, v1.7.0, is not affected.
CVE-2026-38651High 8.2
Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0.
Affected: fixed in 1.5.0.
Fixed in v1.5.0 (released Feb 11, 2026, 76 days before disclosure).
The latest release, v1.7.0, is not affected.
CVE-2026-29196High 8.7
Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys
Affected: fixed in 1.5.0.
Fixed in v1.5.0 (released Feb 11, 2026, 24 days before disclosure).
The latest release, v1.7.0, is not affected.
CVE-2026-29195Medium 6.9
Netmaker: Privilege Escalation from Admin to Super-Admin via User Update
Affected: fixed in 1.5.0.
Fixed in v1.5.0 (released Feb 11, 2026, 24 days before disclosure).
The latest release, v1.7.0, is not affected.
CVE-2026-29194High 8.6
Netmaker: Insufficient Authorization in Host Token Verification
Affected: fixed in 1.5.0.
Fixed in v1.5.0 (released Feb 11, 2026, 24 days before disclosure).
The latest release, v1.7.0, is not affected.
CVE-2026-29771High 8.7
Netmaker: Denial of Service via Server Shutdown Endpoint
Affected: fixed in 1.2.0.
Fixed in v1.2.0 (released Nov 7, 2025, 120 days before disclosure).
The latest release, v1.7.0, is not affected.
CVE-2023-32079High 8.8
Netmaker Privilige Escalation Vulnerability
Affected: fixed in 0.17.1; from 0.18.0, fixed in 0.18.6; fixed in 0.17.1; from 0.18.0, fixed in 0.18.6.
Fixed in v0.17.1 (released Dec 13, 2022, 254 days before disclosure) and v0.18.6 (released Apr 13, 2023, 133 days before disclosure).
The latest release, v1.7.0, is not affected.
CVE-2023-32078High 7.5
Netmaker IDOR Vulnerability Allows User to Update Other User's Password
Affected: fixed in 0.17.1; from 0.18.0, fixed in 0.18.6; fixed in 0.17.1; from 0.18.0, fixed in 0.18.6.
Fixed in v0.17.1 (released Dec 13, 2022, 254 days before disclosure) and v0.18.6 (released Apr 13, 2023, 133 days before disclosure).
The latest release, v1.7.0, is not affected.
CVE-2023-32077High 7.5
Netmaker has Hardcoded DNS Secret Key
Affected: fixed in 0.17.1; from 0.18.0, fixed in 0.18.6; fixed in 0.17.1; from 0.18.0, fixed in 0.18.6.
Fixed in v0.17.1 (released Dec 13, 2022, 254 days before disclosure) and v0.18.6 (released Apr 13, 2023, 133 days before disclosure).
The latest release, v1.7.0, is not affected.
CVE-2022-36110High 8.8
Netmaker vulnerable to Insufficient Granularity of Access Control
Affected: fixed in 0.15.1.
Fixed in v0.15.1 (released Sep 7, 2022, 2 days before disclosure).
The latest release, v1.7.0, is not affected.
CVE-2022-23650High 7.2
Use of Hard-coded Cryptographic Key in Netmaker
Affected: fixed in 0.8.5; from 0.9.0, fixed in 0.9.4; fixed in 0.8.5; from 0.9.0, fixed in 0.9.4.
Fixed in v0.8.5 (released Nov 3, 2021, 107 days before disclosure) and v0.9.4 (released Jan 16, 2022, 33 days before disclosure).
The latest release, v1.7.0, is not affected.
CVE-2022-0664High 8.8
Use of Hard-coded Cryptographic Key in gravitl/netmaker
Affected: fixed in 0.8.5; from 0.9.0, fixed in 0.9.4; fixed in 0.8.5; from 0.9.0, fixed in 0.9.4.
Fixed in v0.8.5 (released Nov 3, 2021, 107 days before disclosure) and v0.9.4 (released Jan 16, 2022, 33 days before disclosure).
The latest release, v1.7.0, is not affected.