# github.com/gravitl/netmaker (Go) vulnerabilities 12 known vulnerabilities (10 high, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v1.7.0 (Aug 31, 2026): no advisory affects it - Newest unaffected release: v1.7.0 (Aug 31, 2026), the latest release - Releases: 78 since v0.5.5 (Jul 11, 2021) - Registry: https://pkg.go.dev/github.com/gravitl/netmaker - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-32599: v0.5.5 to v1.4.0 (v1.5.0 is outside it) - CVE-2026-38651: v0.5.5 to v1.4.0 (v1.5.0 is outside it) - CVE-2026-29196: v0.5.5 to v1.4.0 (v1.5.0 is outside it) - CVE-2026-29195: v0.5.5 to v1.4.0 (v1.5.0 is outside it) - CVE-2026-29194: v0.5.5 to v1.4.0 (v1.5.0 is outside it) - CVE-2026-29771: v0.5.5 to v1.1.0 (v1.2.0 is outside it) - CVE-2023-32079: v0.5.5 to v0.17.0 (v0.17.1 is outside it); v0.18.0 to v0.18.4 (v0.18.6 is outside it) - CVE-2023-32078: v0.5.5 to v0.17.0 (v0.17.1 is outside it); v0.18.0 to v0.18.4 (v0.18.6 is outside it) - CVE-2023-32077: v0.5.5 to v0.17.0 (v0.17.1 is outside it); v0.18.0 to v0.18.4 (v0.18.6 is outside it) - CVE-2022-36110: v0.5.5 to v0.15.0 (v0.15.1 is outside it) - CVE-2022-23650: v0.5.5 to v0.8.4 (v0.8.5 is outside it); v0.9.0 to v0.9.3 (v0.9.4 is outside it) - CVE-2022-0664: v0.5.5 to v0.8.4 (v0.8.5 is outside it); v0.9.0 to v0.9.3 (v0.9.4 is outside it) ## Advisories (12) ### [CVE-2026-32599](https://cve.now/CVE-2026-32599): Netmaker has a boolean‑based SQL Injection - Severity: Medium 5.3 - Published: Sep 15, 2026 - Affected: fixed in 1.5.0. - Fixed in v1.5.0 (released Feb 11, 2026, 216 days before disclosure). - The latest release, v1.7.0, is not affected. ### [CVE-2026-38651](https://cve.now/CVE-2026-38651): Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. - Severity: High 8.2 - Published: Apr 28, 2026 - Affected: fixed in 1.5.0. - Fixed in v1.5.0 (released Feb 11, 2026, 76 days before disclosure). - The latest release, v1.7.0, is not affected. ### [CVE-2026-29196](https://cve.now/CVE-2026-29196): Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys - Severity: High 8.7 - Published: Mar 7, 2026 - Affected: fixed in 1.5.0. - Fixed in v1.5.0 (released Feb 11, 2026, 24 days before disclosure). - The latest release, v1.7.0, is not affected. ### [CVE-2026-29195](https://cve.now/CVE-2026-29195): Netmaker: Privilege Escalation from Admin to Super-Admin via User Update - Severity: Medium 6.9 - Published: Mar 7, 2026 - Affected: fixed in 1.5.0. - Fixed in v1.5.0 (released Feb 11, 2026, 24 days before disclosure). - The latest release, v1.7.0, is not affected. ### [CVE-2026-29194](https://cve.now/CVE-2026-29194): Netmaker: Insufficient Authorization in Host Token Verification - Severity: High 8.6 - Published: Mar 7, 2026 - Affected: fixed in 1.5.0. - Fixed in v1.5.0 (released Feb 11, 2026, 24 days before disclosure). - The latest release, v1.7.0, is not affected. ### [CVE-2026-29771](https://cve.now/CVE-2026-29771): Netmaker: Denial of Service via Server Shutdown Endpoint - Severity: High 8.7 - Published: Mar 7, 2026 - Affected: fixed in 1.2.0. - Fixed in v1.2.0 (released Nov 7, 2025, 120 days before disclosure). - The latest release, v1.7.0, is not affected. ### [CVE-2023-32079](https://cve.now/CVE-2023-32079): Netmaker Privilige Escalation Vulnerability - Severity: High 8.8 - Published: Aug 24, 2023 - Affected: fixed in 0.17.1; from 0.18.0, fixed in 0.18.6; fixed in 0.17.1; from 0.18.0, fixed in 0.18.6. - Fixed in v0.17.1 (released Dec 13, 2022, 254 days before disclosure) and v0.18.6 (released Apr 13, 2023, 133 days before disclosure). - The latest release, v1.7.0, is not affected. ### [CVE-2023-32078](https://cve.now/CVE-2023-32078): Netmaker IDOR Vulnerability Allows User to Update Other User's Password - Severity: High 7.5 - Published: Aug 24, 2023 - Affected: fixed in 0.17.1; from 0.18.0, fixed in 0.18.6; fixed in 0.17.1; from 0.18.0, fixed in 0.18.6. - Fixed in v0.17.1 (released Dec 13, 2022, 254 days before disclosure) and v0.18.6 (released Apr 13, 2023, 133 days before disclosure). - The latest release, v1.7.0, is not affected. ### [CVE-2023-32077](https://cve.now/CVE-2023-32077): Netmaker has Hardcoded DNS Secret Key - Severity: High 7.5 - Published: Aug 24, 2023 - Affected: fixed in 0.17.1; from 0.18.0, fixed in 0.18.6; fixed in 0.17.1; from 0.18.0, fixed in 0.18.6. - Fixed in v0.17.1 (released Dec 13, 2022, 254 days before disclosure) and v0.18.6 (released Apr 13, 2023, 133 days before disclosure). - The latest release, v1.7.0, is not affected. ### [CVE-2022-36110](https://cve.now/CVE-2022-36110): Netmaker vulnerable to Insufficient Granularity of Access Control - Severity: High 8.8 - Published: Sep 9, 2022 - Affected: fixed in 0.15.1. - Fixed in v0.15.1 (released Sep 7, 2022, 2 days before disclosure). - The latest release, v1.7.0, is not affected. ### [CVE-2022-23650](https://cve.now/CVE-2022-23650): Use of Hard-coded Cryptographic Key in Netmaker - Severity: High 7.2 - Published: Feb 18, 2022 - Affected: fixed in 0.8.5; from 0.9.0, fixed in 0.9.4; fixed in 0.8.5; from 0.9.0, fixed in 0.9.4. - Fixed in v0.8.5 (released Nov 3, 2021, 107 days before disclosure) and v0.9.4 (released Jan 16, 2022, 33 days before disclosure). - The latest release, v1.7.0, is not affected. ### [CVE-2022-0664](https://cve.now/CVE-2022-0664): Use of Hard-coded Cryptographic Key in gravitl/netmaker - Severity: High 8.8 - Published: Feb 18, 2022 - Affected: fixed in 0.8.5; from 0.9.0, fixed in 0.9.4; fixed in 0.8.5; from 0.9.0, fixed in 0.9.4. - Fixed in v0.8.5 (released Nov 3, 2021, 107 days before disclosure) and v0.9.4 (released Jan 16, 2022, 33 days before disclosure). - The latest release, v1.7.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/gravitl/netmaker Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.