Skip to contentJuev Nebula-mesh vulnerabilities
- forgekeep nebula-meshNebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`CVE-2026-63464Fix available7.7 High
- forgekeep nebula-meshnebula-mesh: Certificate revocation is never enforced at the meshCVE-2026-61699Fix available8.1 High
- forgekeep nebula-meshnebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokensCVE-2026-55513Fix available5.4 Medium
- forgekeep nebula-meshnebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limitingCVE-2026-55512Fix available5.3 Medium
- forgekeep nebula-meshnebula-mesh: Operator session tokens stored in plaintext in the databaseCVE-2026-53603Fix available7.1 High
- forgekeep nebula-meshnebula-mesh: CA private key not zeroized on web mobile-bundle error pathsCVE-2026-53604Fix available7.1 High
- forgekeep nebula-meshnebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificateCVE-2026-53602Fix available6.9 Medium
- juev nebula-meshNebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)CVE-2026-492588.8 High
- juev nebula-meshnebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)CVE-2026-47768Fix available5.5 Medium
- juev nebula-meshnebula-mesh: Session and OIDC state cookies lack the Secure attributeCVE-2026-48058Fix available4.6 Medium
- juev nebula-meshnebula-mesh: Decrypted CA private key persists in heap after signingCVE-2026-48025Fix available6.9 Medium
- juev nebula-meshnebula-mesh: GET /api/v1/audit-log discloses all entries to any operatorCVE-2026-47726Fix available7.1 High
- juev nebula-meshnebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpointsCVE-2026-47725Fix available6.9 Medium
- juev nebula-meshnebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalationCVE-2026-47724Fix available9.9 Critical
- juev nebula-meshnebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)CVE-2026-47723Fix available7.1 High
- juev nebula-meshnebula-mesh: Host advanced overrides allow YAML injection into agent config.ymlCVE-2026-47722Fix available8.7 High