PatchSiren

PatchSiren cyber security CVE debrief

CVE-2022-36110 gravitl CVE debrief

CVE-2022-36110 is a HIGH severity (CVSS 8.8) improper authorization vulnerability in Netmaker, a WireGuard-based network management platform. Published 2022-09-09, this flaw allowed non-privileged users to execute administrative API functions using their authentication tokens due to missing authorization checks. The vulnerability affected all versions prior to 0.15.1. CWE-285 (Improper Authorization) and CWE-1220 (Insufficient Granularity of Access Control) are identified as relevant weaknesses. The vendor patched this issue in version 0.15.1, released September 2022. Organizations should upgrade to v0.15.1 or later and audit user accounts for unauthorized administrative actions taken prior to patching.

Vendor
gravitl
Product
netmaker
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2022-09-09
Original CVE updated
2026-05-18
Advisory published
2022-09-09
Advisory updated
2026-05-18

Who should care

Organizations using Netmaker for WireGuard network management, particularly those with multi-user deployments where non-administrative users have platform access. Security teams responsible for network infrastructure access control and DevOps engineers managing Netmaker deployments should prioritize this patch.

Technical summary

Netmaker versions prior to 0.15.1 failed to properly enforce authorization checks on API endpoints, allowing authenticated non-administrative users to invoke administrative functions. The vulnerability stems from insufficient access control granularity where possession of a valid auth token alone permitted elevated operations without verifying the user's assigned role. This represents a classic broken access control issue (OWASP A01:2021) in API design. The fix in v0.15.1 added proper authorization middleware to validate user privileges before executing sensitive operations.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Netmaker to version 0.15.1 or later to remediate the authorization bypass vulnerability
  • Review Netmaker platform audit logs for unauthorized administrative API calls made by non-admin users between deployment and patch date
  • Validate that user role assignments follow principle of least privilege and that administrative functions require explicit admin role verification
  • Implement network segmentation to limit API access to authorized management hosts where feasible
  • Monitor for anomalous API usage patterns that may indicate exploitation attempts

Evidence notes

Vulnerability confirmed via GitHub Security Advisory GHSA-ggf6-638m-vqmg and NVD record. Patch released in Netmaker v0.15.1. CVSS 3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Official resources

2022-09-09