github.com/forgekeep/nebula-mesh vulnerabilities (Go)
8 vulnerabilities.
-
github.com/forgekeep/nebula-meshGo Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private` 7.7 High -
github.com/forgekeep/nebula-meshGo nebula-mesh: Certificate revocation is never enforced at the mesh 8.1 High -
github.com/forgekeep/nebula-meshGo nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens 5.4 Medium -
github.com/forgekeep/nebula-meshGo nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting 5.3 Medium -
github.com/forgekeep/nebula-meshGo nebula-mesh: Operator session tokens stored in plaintext in the database 7.1 High -
github.com/forgekeep/nebula-meshGo nebula-mesh: CA private key not zeroized on web mobile-bundle error paths 7.1 High -
github.com/forgekeep/nebula-meshGo nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate 6.9 Medium -
github.com/forgekeep/nebula-meshGo nebula-mesh: Decrypted CA private key persists in heap after signing 6.9 Medium