CVE-2026-32599
CVE-2026-32599 is a SQL Injection vulnerability in github.com/gravitl/netmaker. O3 Security confirms whether CVE-2026-32599 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
Netmaker has a boolean‑based SQL Injection
Real-World Exposure
github.com/gravitl/netmakerReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
SQL Injection in Netmaker SQLite Database Backend
Summary
The sqliteDeleteRecord function in Netmaker's database layer constructs SQL DELETE statements using direct string concatenation of user-supplied input. This allows an authenticated attacker to perform boolean-based SQL injection.
Details
The endpoint:
DELETE /api/dns/{network}/{domain}
passes user-controlled path parameters through the following flow:
logic.DeleteDNS → database.DeleteRecord → sqliteDeleteRecord
Depending on the configured database backend, the request eventually reaches the SQLite database implementation.
Vulnerable Code
The SQL query is constructed using direct string concatenation without parameterization.
// database/sqlite.go
deleteSQL := "DELETE FROM " + tableName + " WHERE key = \"" + key + "\""
The key value originates from user input ({domain} path parameter) and is embedded directly into the SQL query.
Exploitation
An authenticated attacker can inject SQL operators into the {domain} path parameter to manipulate the query logic.
Because this injection is boolean-based, attackers extract data indirectly by observing the outcome of the operation:
If the injected condition evaluates true, the DNS record is deleted.
If the condition evaluates false, the DNS record remains.
By repeating this process, an attacker can infer information such as:
Database table names
Column names
Column values
Value lengths
Impact
An authenticated attacker can exploit this vulnerability to extract data from arbitrary database tables when using the SQLite backend.
Unaffected backend:
PostgreSQL (uses parameterised queries with $1, $2 placeholders)
Patches
This vulnerability is fixed in version (fill in).
The patch replaces string concatenation with parameterised SQL queries for all user-supplied values in database operations.
---
Credit
Artem Danilov
(Positive Technologies)
Daniil Satyaev (Independent)
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/gravitl/netmaker | all versions | 1.5.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/gravitl/netmaker. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update github.com/gravitl/netmaker to 1.5.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-32599 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether CVE-2026-32599 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to CVE-2026-32599. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-32599 in your dependencies?
O3 detects CVE-2026-32599 across Go dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.