Juev vulnerabilities

Products

• Nebula-mesh 16

Newest

• forgekeep nebula-mesh Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private` CVE-2026-63464 Fix available 7.7 HighJuly 14, 2026
• forgekeep nebula-mesh nebula-mesh: Certificate revocation is never enforced at the mesh CVE-2026-61699 Fix available 8.1 HighJuly 14, 2026
• forgekeep nebula-mesh nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens CVE-2026-55513 Fix available 5.4 MediumJuly 14, 2026
• forgekeep nebula-mesh nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting CVE-2026-55512 Fix available 5.3 MediumJuly 14, 2026
• forgekeep nebula-mesh nebula-mesh: Operator session tokens stored in plaintext in the database CVE-2026-53603 Fix available 7.1 HighJuly 14, 2026
• forgekeep nebula-mesh nebula-mesh: CA private key not zeroized on web mobile-bundle error paths CVE-2026-53604 Fix available 7.1 HighJuly 14, 2026
• forgekeep nebula-mesh nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate CVE-2026-53602 Fix available 6.9 MediumJuly 9, 2026
• juev nebula-mesh Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete) CVE-2026-49258 8.8 HighJune 26, 2026
• juev nebula-mesh nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs) CVE-2026-47768 Fix available 5.5 MediumJune 10, 2026
• juev nebula-mesh nebula-mesh: Session and OIDC state cookies lack the Secure attribute CVE-2026-48058 Fix available 4.6 MediumJune 10, 2026
• juev nebula-mesh nebula-mesh: Decrypted CA private key persists in heap after signing CVE-2026-48025 Fix available 6.9 MediumJune 10, 2026
• juev nebula-mesh nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator CVE-2026-47726 Fix available 7.1 HighJune 8, 2026
• juev nebula-mesh nebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpoints CVE-2026-47725 Fix available 6.9 MediumJune 8, 2026
• juev nebula-mesh nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation CVE-2026-47724 Fix available 9.9 CriticalJune 8, 2026
• juev nebula-mesh nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.) CVE-2026-47723 Fix available 7.1 HighJune 8, 2026
• juev nebula-mesh nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml CVE-2026-47722 Fix available 8.7 HighJune 8, 2026