# CVE-2023-32077: Netmaker hardcoded DNS secret key in API

Source: https://junglewise.ai/threats/cve-2023-32077-netmaker-hardcoded-dns-secret-key-in-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-08-25. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2023-32077 · Severity: high · CVSS 7.5 · Published 2023-08-25

Netmaker, a platform for managing virtual networking and WireGuard-based VPNs, was found to contain a hardcoded secret key for its DNS component. This flaw allows unauthorized individuals to access and interact with the system's DNS API. An attacker could exploit this to view sensitive network configuration data, potentially compromising the privacy and security of the virtual network.

Technologies: [github.com/gravitl/netmaker (Go)](https://junglewise.ai/threats/technologies/github-com-gravitl-netmaker). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2023-32077 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-32077 being exploited in the wild.

**How severe is CVE-2023-32077?** High severity, with a CVSS score of 7.5, published 25 August 2023.

**Which products and versions are affected?** github.com/gravitl/netmaker (Go) SEMVER:introduced=0,fixed=0.17.1, SEMVER:introduced=0,fixed=0.17.1,introduced=0.18.0,fixed=0.18.6.

**Is there a fix for CVE-2023-32077?** Yes. github.com/gravitl/netmaker (Go): upgrade to 0.17.1, 0.18.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-32077 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2023-32077?** Check whether you run github.com/gravitl/netmaker (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/gravitl/netmaker (Go): upgrade to 0.17.1, 0.18.6 or later

  ```sh
  go get github.com/gravitl/netmaker@v0.18.6
  ```


## Technical details

A vulnerability exists in Netmaker due to the use of a hardcoded cryptographic secret key for DNS API authentication (CWE-321, CWE-798). This allows a remote, unauthenticated attacker to bypass intended security controls and interact directly with DNS API endpoints. By utilizing the static key, an attacker can gain unauthorized access to sensitive network information. The issue is resolved in versions 0.17.1 and 0.18.6+. Users on version 0.17.1 must pull the updated Docker image to apply the fix.

## Affected products

- gravitl Netmaker < 0.17.1, >= 0.18.0, < 0.18.6

## Identifiers

- CVE-2023-32077
- GHSA-8x8h-hcq8-jwwx
- GO-2023-2022

## Timeline

- 2023-08-24: advisory: NVD publication date
- 2023-08-25: disclosed: GitHub Advisory published

## References

- [https://api.github.com/users/rootxharsh](https://api.github.com/users/rootxharsh)
- [https://github.com/rootxharsh](https://github.com/rootxharsh)
- [https://api.github.com/users/rootxharsh/gists%7B/gist_id%7D](https://api.github.com/users/rootxharsh/gists%7B/gist_id%7D)
- [https://api.github.com/users/rootxharsh/repos](https://api.github.com/users/rootxharsh/repos)
- [https://avatars.githubusercontent.com/u/21000421?v=4](https://avatars.githubusercontent.com/u/21000421?v=4)
- [https://api.github.com/users/rootxharsh/events%7B/privacy%7D](https://api.github.com/users/rootxharsh/events%7B/privacy%7D)

## Related threats

- [Netmaker boolean-based SQL injection in DNS deletion](https://junglewise.ai/threats/cve-2026-32599-netmaker-boolean-based-sql-injection-in-dns-deletion)
- [Gravitl Netmaker authentication bypass in VerifyHostToken](https://junglewise.ai/threats/cve-2026-38651-gravitl-netmaker-authentication-bypass-in-verifyhosttoken)
- [Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys](https://junglewise.ai/threats/cve-2026-29196-netmaker-service-user-with-network-access-can-access-config-files)
- [GO-2026-4654 - Netmaker has Privilege Escalation from Admin to Super-Admin via User Update in github.com/gravitl/netmaker](https://junglewise.ai/threats/cve-2026-29195-netmaker-has-privilege-escalation-from-admin-to-super-admin-via)
- [GO-2026-4655 - Netmaker has Insufficient Authorization in Host Token Verification in github.com/gravitl/netmaker](https://junglewise.ai/threats/cve-2026-29194-netmaker-has-insufficient-authorization-in-host-token)