CVE-2026-47722
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
In nebula-mesh before version 0.3.2, in internal/configgen/generator.go, the ListenHost and TunDevice fields are interpolated without validation into a text/template, potentially leading to code injection. internal/web/advanced.go accepts these fields with only whitespace trimming, no character or shape validation.
Risk Assessment
An attacker could inject malicious code into the agent configuration, potentially leading to agent compromise or further attacks on the mesh network.
Recommendation
Update nebula-mesh to version 0.3.2 or later, which includes validation for ListenHost and TunDevice fields.
Other vulnerabilities in nebula-mesh
See all- CVE-2026-47724Critical
Vulnerability in nebula-mesh allows privilege escalation due to missing access controls on many API endpoints. Any operator with an API key can access resources of other operators.
- CVE-2026-49258High
Nebula Mesh versions 0.3.5 and below do not apply per-operator CA scoping in the web UI, allowing any authenticated non-admin operator to access resources belonging to other operators. This was partially fixed in GHSA-598g-h2vc-h5vg but the web UI was not covered.
- CVE-2026-48058Medium
nebula-mesh before version 0.3.2 sets HttpOnly and SameSite=Lax flags on cookies but never sets the Secure flag. A single plaintext request to the origin (e.g., operator on a LAN, mistyped URL, HTTP→HTTPS not strictly enforced, reverse proxy misconfiguration) discloses the session.
- CVE-2026-47768Medium
In nebula-mesh prior to version 0.3.2, a newly minted operator API key was exposed in the redirect URL, potentially leaking via Referer header, browser history, or proxy logs. This issue has been fixed in version 0.3.2.
- CVE-2026-47726High
nebula-mesh versions prior to 0.3.2 do not perform admin checks on the audit log endpoint. Any operator with an API key can read the full audit log, including cross-tenant data.
- CVE-2026-47725Medium
In nebula-mesh prior to version 0.3.3, all /ui/* POST/PUT/PATCH/DELETE routes process requests immediately after session cookie validation. SameSite=Lax does not protect against cross-site form submissions from third-party domains (e.g., top-level navigations, sibling-subdomain attacks) or against the GET /ui/logout route. This issue has been fixed in version 0.3.3.
- CVE-2026-48025Medium
In nebula-mesh prior to version 0.3.7, decrypted CA private keys remain in the process heap after use because they are not zeroed before memory release. This violates the keystore package contract and could lead to key leakage. This issue has been fixed in version 0.3.7.
- CVE-2026-47723High
In nebula-mesh before version 0.3.1, standard browser security headers (Content-Security-Policy, X-Frame-Options, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy) are missing in the internal/web/ and internal/api/ response paths. Fixed in version 0.3.1.
Original NVD description (English source)
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, `internal/configgen/generator.go:86,108,119` interpolates the operator-supplied `ListenHost` and `TunDevice` fields raw into a `text/template` that produces the agent's `config.yml`. `internal/web/advanced.go:20-35` accepts both with only `strings.TrimSpace` — no character or shape validation. Version 0.3.2 fixes the issue.