← Vulnerability feed

Vulnerability record · CVE-2022-23650 · published 18 February 2022

CVE-2022-23650: Netmaker hard-coded credentials vulnerability

Netmaker · Netmaker

Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and username of the admin. This effects the server (netmaker) component, and not clients. This has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. There are currently no known workarounds.

8.8 CVSS 3.1 High EPSS 1.6% · top 25.8% CWE-321 · CWE-321CWE-798 · Hard-coded credentials
8.8CVSS 3.1 base score, v2 9.0
1.6%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References
17 Jun 2026Last modified by NVD

Description

Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and username of the admin. This effects the server (netmaker) component, and not clients. This has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. There are currently no known workarounds.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee PatchThird Party Advisory
https://github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080 PatchThird Party Advisory
https://github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87 PatchThird Party Advisory
https://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4 Third Party Advisory
https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee PatchThird Party Advisory
https://github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080 PatchThird Party Advisory
https://github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87 PatchThird Party Advisory
https://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4 Third Party Advisory

Track CVE-2022-23650 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-0664Netmaker vulnerabilityUse of Hard-coded Cryptographic Key in Go github.com/gravitl/netmaker prior to 0.8.5,0.9.4,0.10.0,0.10.1.EPSS 1.7%8.8CVE-2023-32079Netmaker mass assignment vulnerabilityNetmaker makes networks with WireGuard. A Mass assignment vulnerability was found in versions prior to 0.17.1 and 0.18.6 that allows a non-admin user…EPSS 0.87%8.8CVE-2022-36110Netmaker improper authorization vulnerabilityNetmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API…EPSS 0.89%8.7CVE-2026-29771Netmaker improper resource shutdown vulnerabilityNetmaker makes networks with WireGuard. Prior to version 1.2.0, the /api/server/shutdown endpoint allows termination of the Netmaker server process v…EPSS 0.42%8.2CVE-2026-38651Netmaker improper verification of cryptographic signature vulnerabilityAuthentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validate the J…EPSS 0.44%7.5CVE-2023-32078Netmaker insecure direct object reference vulnerabilityNetmaker makes networks with WireGuard. An Insecure Direct Object Reference (IDOR) vulnerability was found in versions prior to 0.17.1 and 0.18.6 in …EPSS 0.70%7.5CVE-2023-32077Netmaker hard-coded credentials vulnerabilityNetmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users…EPSS 3.5%9.8CVE-2025-30406Gladinet CentreStack hardcoded machineKey deserialization RCEGladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) uses a hardcoded machineKey in the portal's web.config, allowing deserializ…KEVEPSS 94%analysed

Source: NIST National Vulnerability Database (record CVE-2022-23650), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.