PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-32077 Netmaker CVE debrief

CVE-2023-32077 is a high-severity Netmaker vulnerability where hardcoded DNS key usage could let unauthenticated attackers interact with DNS API endpoints. The issue affects releases prior to 0.17.1 and 0.18.6, with the vendor and NVD pointing to patched commits and an advisory for remediation. Because the flaw is network-reachable and requires no credentials, it should be treated as a priority fix for any exposed Netmaker deployment.

Vendor
Netmaker
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2023-08-24
Original CVE updated
2026-05-18
Advisory published
2023-08-24
Advisory updated
2026-05-18

Who should care

Administrators and operators of Netmaker installations, especially internet-exposed or broadly reachable deployments, should care most. Security teams responsible for containerized Netmaker stacks and anyone running versions before 0.17.1 or 0.18.6 should verify they are on a fixed release.

Technical summary

NVD describes the flaw as hardcoded DNS key usage in Netmaker that allows unauthenticated users to interact with DNS API endpoints. The published CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating a remotely reachable issue with no privileges or user interaction required and high confidentiality impact. NVD lists affected version ranges as Netmaker versions earlier than 0.17.1 and versions 0.18.0 through 0.18.5. The advisory metadata also maps the issue to CWE-798 and CWE-321, consistent with insecure credential handling / hardcoded secret use.

Defensive priority

High. This is a remotely exploitable, unauthenticated issue affecting a security-sensitive service surface. Even without integrity or availability impact, the lack of authentication and high confidentiality impact warrant prompt remediation.

Recommended defensive actions

  • Upgrade to Netmaker 0.18.6 or later if you are on 0.18.0 through 0.18.5.
  • If you are on 0.17.1, deploy the patched 0.17.1 image as instructed by the vendor and restart the stack.
  • Confirm the running backend image and compose deployment match the fixed release after upgrading.
  • Review exposure of Netmaker DNS API endpoints and restrict network access to trusted management paths where possible.
  • Monitor for unexpected DNS API access while validating that the patched version is active.

Evidence notes

The CVE record and NVD metadata state the vulnerability is due to hardcoded DNS key usage and that unauthenticated users can interact with DNS API endpoints. NVD marks the record as Published on 2023-08-24 and Modified on 2026-05-18; the modified date reflects record updates, not the original issue date. The advisory metadata cites patch references at GitHub commit 1621c27c1d176b639e9768b2acad7693e387fd51, commit 9362c39a9a822f0e07361aa7c77af2610597e657, pull request 2170, and GitHub Security Advisory GHSA-8x8h-hcq8-jwwx.

Official resources

Publicly disclosed on 2023-08-24 22:15:08.077Z. The supplied NVD record was later modified on 2026-05-18 16:44:17.500Z; that later timestamp should be treated as a record update, not the original vulnerability date.