Skip to content
OpenAdvisories

Package · Go

github.com/juev/nebula-mesh

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-55513

    nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens

    nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path ignores both the server-wide enrollment_token_ttl security setting and per-network network_config.enrol…

    forgekeep nebula-mesh github.com/juev/nebula-mesh github.com/forgekeep/nebula-mesh Go
  • Medium 5.3
    CVE-2026-55512

    nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting

    nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.2.0 to before version 0.5.0, when OIDC is enabled, GET /ui/oidc/login is reachable without authentication and is registered outside the Web UI rate-limited auth routes. Every…

    forgekeep nebula-mesh github.com/juev/nebula-mesh github.com/forgekeep/nebula-mesh Go
  • Medium 4.6
    CVE-2026-48058

    nebula-mesh: Session and OIDC state cookies lack the Secure attribute

    nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to th…

    juev nebula-mesh github.com/juev/nebula-mesh Go
  • Medium 5.5
    CVE-2026-47768

    nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)

    nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs). This issue has been patched in version 0.3.2.

    juev nebula-mesh github.com/juev/nebula-mesh Go
  • Medium 6.9
    CVE-2026-47725

    nebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpoints

    nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/* POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie p…

    juev nebula-mesh github.com/juev/nebula-mesh Go
  • Medium 6.9
    CVE-2026-48025

    nebula-mesh: Decrypted CA private key persists in heap after signing

    nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.7, internal/pki/resolver.go:36-64 constructs a CAManager with the plaintext ed25519.PrivateKey after unwrapping via the master key; internal/pki/ca.…

    juev nebula-mesh github.com/juev/nebula-mesh github.com/forgekeep/nebula-mesh Go
  • Medium —
    GHSA-ghmh-jhmj-wcmf

    nebula-mesh's stores enrollment tokens unhashed in SQLite

    `internal/store/sqlite.go:1177,1192,1221,1245` — the `enrollment_tokens.token` column holds the raw UUID token. `ConsumeToken` does `WHERE token = ?` against the raw string. Compare with `operator_api_keys.key_hash`, which is SHA-256 hex (constructed in `inte…

    github.com/juev/nebula-mesh Go