Skip to content
OpenAdvisories

Vendor

forgekeep

7 known vulnerabilities.

Products

nebula-mesh 7
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-55513

    nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens

    nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path ignores both the server-wide enrollment_token_ttl security setting and per-network network_config.enrol…

    forgekeep nebula-mesh github.com/juev/nebula-mesh github.com/forgekeep/nebula-mesh Go
  • Medium 5.3
    CVE-2026-55512

    nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting

    nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.2.0 to before version 0.5.0, when OIDC is enabled, GET /ui/oidc/login is reachable without authentication and is registered outside the Web UI rate-limited auth routes. Every…

    forgekeep nebula-mesh github.com/juev/nebula-mesh github.com/forgekeep/nebula-mesh Go
  • Medium 6.9
    CVE-2026-53602

    nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate

    nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula certificate, because nebula-mgmt does not re-evaluate revocat…

    forgekeep nebula-mesh github.com/forgekeep/nebula-mesh Go