CVE-2022-4968

netplan leaks the private key of wireguard to local users. A security fix will be released soon.

6.5 MediumFix available

netplan leaks the private key of wireguard to local users. Versions after 1.0 are not affected.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.26%Up 0.2 points since Jun 7, 2024

What each source reports

CVE List Score used 6.5

netplan leaks the private key of wireguard to local users. Versions after 1.0 are not affected.

Record: CVE-2022-4968
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-497
Updated: 2026-11-02

EUVDEUVD-2022-53922 6.5

netplan leaks the private key of wireguard to local users. Versions after 1.0 are not affected.

Record: EUVD-2022-53922
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-xpvm-9wx5-vjpw 6.5

netplan leaks the private key of wireguard to local users. A security fix will be released soon.

netplan leaks the private key of wireguard to local users. A security fix will be released soon.

Record: GHSA-xpvm-9wx5-vjpw
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-200, CWE-497
Updated: 2026-11-02

NVD 6.5

netplan leaks the private key of wireguard to local users. Versions after 1.0 are not affected.

Record: CVE-2022-4968
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-497
Updated: 2026-11-02

OSVAZL-51921 6.5

CVE-2022-4968 affecting package netplan for versions less than 1.0.1-1

netplan leaks the private key of wireguard to local users. Versions after 1.0 are not affected.

Record: AZL-51921
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVAZL-51964 6.5

CVE-2022-4968 affecting package netplan for versions less than 0.95-3

netplan leaks the private key of wireguard to local users. Versions after 1.0 are not affected.

Record: AZL-51964
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

Show 4 moreShow less

OSV 6.5

netplan leaks the private key of wireguard to local users. Versions after 1.0 are not affected.

Record: CVE-2022-4968
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-497
Updated: 2026-11-02

OSVDEBIAN-CVE-2022-4968 6.5

netplan leaks the private key of wireguard to local users. Versions after 1.0 are not affected.

Record: DEBIAN-CVE-2022-4968
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-03

OSVUBUNTU-CVE-2022-4968 6.5

netplan leaks the private key of wireguard to local users. Versions after 1.0 are not affected.

Record: UBUNTU-CVE-2022-4968
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVUSN-6851-1 No score

netplan.io vulnerabilities

Andreas Hasenack discovered that netplan incorrectly handled the permissions for netdev files containing wireguard configuration. An attacker could use this to obtain wireguard secret keys.

It was discovered that netplan configuration could be manipulated into injecting arbitrary commands while setting up network interfaces. An attacker could use this to execute arbitrary commands or escalate privileges.

Record: USN-6851-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`netplan` Azure Linux:3	before 1.0.1-1	1.0.1-1
`netplan` Azure Linux:2	before 0.95-3	0.95-3
`netplan.io` Debian:12	All versions, plus listed versions 0.106-20.106-2+deb12u10.106-30.106-4~exp10.106.1-1 Show 45 moreShow less 0.106.1-20.106.1-30.106.1-40.106.1-50.106.1-60.106.1-70.106.1-80.106.1-8~exp10.107-10.107-20.107-30.107-3~exp10.107-40.107-50.107.1-10.107.1-20.107.1-30.107.1-3+exp11.0-11.0-21.0-2.11.0-31.0-41.0-51.0-61.0-6+exp11.0.1-11.0.1-21.0.1-31.1-11.1-21.1.1-11.1.2-11.1.2-21.1.2-31.1.2-41.1.2-51.1.2-5~exp11.1.2-5~exp21.1.2-61.1.2-71.1.2-81.2-11.2.1-11.2.2-1	None known
`netplan.io` Debian:13	before 1.0.1-1	1.0.1-1
`netplan.io` Debian:14	before 1.0.1-1	1.0.1-1
`netplan.io` Ubuntu:18.04:LTS	All versions, plus listed versions 0.340.34.10.350.36.10.36.2 Show 12 moreShow less 0.36.30.40.1~18.04.20.40.1~18.04.30.40.1~18.04.40.96-0ubuntu0.18.04.40.97-0ubuntu1~18.04.10.98-0ubuntu1~18.04.10.99-0ubuntu3~18.04.10.99-0ubuntu3~18.04.20.99-0ubuntu3~18.04.30.99-0ubuntu3~18.04.40.99-0ubuntu3~18.04.5	None known
`netplan.io` Ubuntu:20.04:LTS	before 0.104-0ubuntu2~20.04.5, plus listed versions 0.98-0ubuntu10.98-0ubuntu20.98-0ubuntu30.98-0ubuntu40.99-0ubuntu1 Show 16 moreShow less 0.99-0ubuntu20.99-0ubuntu3~20.04.10.99-0ubuntu3~20.04.20.100-0ubuntu4~20.04.20.100-0ubuntu4~20.04.30.101-0ubuntu3~20.04.20.102-0ubuntu1~20.04.10.102-0ubuntu1~20.04.20.103-0ubuntu5~20.04.10.103-0ubuntu5~20.04.20.103-0ubuntu5~20.04.30.103-0ubuntu5~20.04.50.103-0ubuntu5~20.04.60.104-0ubuntu2~20.04.10.104-0ubuntu2~20.04.20.104-0ubuntu2~20.04.4	0.104-0ubuntu2~20.04.5
`netplan.io` Ubuntu:22.04:LTS	before 0.106.1-7ubuntu0.22.04.3, plus listed versions 0.103-0ubuntu70.103-0ubuntu80.103-0ubuntu90.103-0ubuntu100.104-0ubuntu1 Show 5 moreShow less 0.104-0ubuntu20.104-0ubuntu2.10.105-0ubuntu2~22.04.10.105-0ubuntu2~22.04.30.106.1-7ubuntu0.22.04.2	0.106.1-7ubuntu0.22.04.3
`netplan.io` Ubuntu:24.04:LTS	before 1.0-2ubuntu1.1, plus listed versions 0.107-50.107-5ubuntu10.107-5ubuntu20.107.1-31.0-11.0-21.0-2build11.0-2ubuntu1	1.0-2ubuntu1.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-4968 is a medium vulnerability (CVSS 6.5) in Canonical Netplan, published June 7, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 18th percentile. Fixed in netplan 1.0.1-1.

References

Show 8 moreShow less

This page doesn't list everything

Left out here: 2 versions. The JSON record has them.