Skip to content
OpenAdvisories

Package · Go

github.com/juev/nebula-mesh

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.8
    CVE-2026-49258

    Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)

    Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI (/ui/*) does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5vg, but the changes…

    juev nebula-mesh github.com/juev/nebula-mesh Go
  • High 7.1
    CVE-2026-47726

    nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator

    nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audi…

    juev nebula-mesh github.com/juev/nebula-mesh Go
  • High 7.1
    CVE-2026-47723

    nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)

    nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in `internal/web/` or `internal/api/` set the standard browser-security headers. `grep` for `Content-Security-Policy`,…

    juev nebula-mesh github.com/juev/nebula-mesh Go
  • High 8.7
    CVE-2026-47722

    nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml

    nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, `internal/configgen/generator.go:86,108,119` interpolates the operator-supplied `ListenHost` and `TunDevice` fields raw into a `text/template` th…

    juev nebula-mesh github.com/juev/nebula-mesh Go