CVE-2022-23650: Github.com/gravitl/netmaker Use Of Hard-coded Cryptographic Key Vulnerability
HIGHCVE-2022-23650 is a HIGH (CVSS 7.2) use of hard-coded cryptographic key vulnerability (CWE-321: Use of Hard-coded Cryptographic Key) affecting Github.com/gravitl/netmaker libraries in the Go ecosystem. The issue involves use of hard-coded cryptographic key in netmaker. Remediation is available by upgrading affected packages to version 0.8.5, 0.9.4.
CVE-2022-23650 at a Glance
Security Impact
CVSS: 7.2
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
How to Fix CVE-2022-23650
To remediate this vulnerability, upgrade all affected Github.com/gravitl/netmaker dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/gravitl/netmaker to 0.8.5Upgrade github.com/gravitl/netmaker to 0.9.4Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/gravitl/netmakerHow to Check if You Are Affected
To determine whether your application is affected by CVE-2022-23650, inspect your project dependencies for Github.com/gravitl/netmaker:
inspect dependencies for github.com/gravitl/netmakerAnalyze the terminal output to locate any version of Github.com/gravitl/netmaker in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.8.5), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-321: Use of Hard-coded Cryptographic Key, where the product uses a hard-coded, unchangeable cryptographic key. In Github.com/gravitl/netmaker, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2022-23650 Affected Github.com/gravitl/netmaker Versions
2 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/gravitl/netmaker
|
Go |
< 0.8.5
|
0.8.5
|
|
github.com/gravitl/netmaker
|
Go |
≥ 0.9.0
< 0.9.4
|
0.9.4
|
References
Frequently Asked Questions
What is CVE-2022-23650?
Which Github.com/gravitl/netmaker versions are affected?
What version fixes CVE-2022-23650?
Is github.com/gravitl/netmaker affected?
What is the CVSS score of CVE-2022-23650?
What CWE is associated with CVE-2022-23650?
How can I check Go dependencies for CVE-2022-23650?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-86f3-hf24-76q4",
"modified" : "2026-05-19T16:06:11Z",
"published" : "2022-02-22T19:40:23Z",
"aliases" : [ "CVE-2022-23650" ],
"summary" : "Use of Hard-coded Cryptographic Key in Netmaker",
"details" : "### Impact\nThere is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server, if you know the address and username of the admin. This effects the server (netmaker) component, and not clients.\n\n### Patches\nThis has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. If you are running these versions, the fix is to perform the following:\n\n1. docker-compose down\n2. docker pull gravitl/netmaker:( version )\n3. docker-compose up -d\n\n#### Additional Information\nIf you are running **any other version**, you will need to upgrade to one of these three versions. If you have a special circumstance that requires running a different version, let us know and we may be able to build a custom patch.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [info@gravitl.com](mailto:info@gravitl.com)",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/gravitl/netmaker"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.8.5"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/gravitl/netmaker"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0.9.0"
}, {
"fixed" : "0.9.4"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2022-23650"
}, {
"type" : "WEB",
"url" : "https://github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87"
}, {
"type" : "WEB",
"url" : "https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee"
}, {
"type" : "WEB",
"url" : "https://github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/gravitl/netmaker"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-321", "CWE-798" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2022-02-22T19:40:23Z",
"nvd_published_at" : "2022-02-18T22:15:00Z"
}
}