github.com/gravitl/netmaker (Go) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Go package github.com/gravitl/netmaker, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (11)

• CVE-2022-0664 — CVSS 9.8 (critical): Use of Hard-coded Cryptographic Key in Go github.com/gravitl/netmaker prior to 0.8.5,0.9.4,0.10.0,0.10.1.
• CVE-2022-36110 — CVSS 8.8 (high): Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running…
• CVE-2023-32079 — CVSS 8.8 (high): Netmaker makes networks with WireGuard. A Mass assignment vulnerability was found in versions prior to 0.17.1 and 0.18.6 that allows a…
• CVE-2026-38651 — CVSS 8.2 (high): Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to…
• CVE-2026-29194 — CVSS 8.1 (high): Netmaker makes networks with WireGuard. Prior to version 1.5.0, the Authorize middleware in Netmaker incorrectly validates host JWT tokens…
• CVE-2023-32077 — CVSS 7.5 (high): Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing…
• CVE-2023-32078 — CVSS 7.5 (high): Netmaker makes networks with WireGuard. An Insecure Direct Object Reference (IDOR) vulnerability was found in versions prior to 0.17.1 and…
• CVE-2022-23650 — CVSS 7.2 (high): Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there…
• CVE-2026-29195 — CVSS 6.5 (medium): Netmaker makes networks with WireGuard. Prior to version 1.5.0, the user update handler (PUT /api/users/{username}) lacks validation to…
• CVE-2026-29771 — CVSS 6.5 (medium): Netmaker makes networks with WireGuard. Prior to version 1.2.0, the /api/server/shutdown endpoint allows termination of the Netmaker server…
• CVE-2026-29196 — CVSS 4.3 (medium): Netmaker makes networks with WireGuard. Prior to version 1.5.0, a user assigned the platform-user role can retrieve WireGuard private keys…