CVE-2026-47725
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In nebula-mesh prior to version 0.3.3, all /ui/* POST/PUT/PATCH/DELETE routes process requests immediately after session cookie validation. SameSite=Lax does not protect against cross-site form submissions from third-party domains (e.g., top-level navigations, sibling-subdomain attacks) or against the GET /ui/logout route. This issue has been fixed in version 0.3.3.
Risk Assessment
An attacker could perform unauthorized operations on the UI or log out the administrator, potentially compromising panel integrity and availability.
Recommendation
Upgrade nebula-mesh to version 0.3.3 or later.
Other vulnerabilities in nebula-mesh
See all- CVE-2026-47724Critical
Vulnerability in nebula-mesh allows privilege escalation due to missing access controls on many API endpoints. Any operator with an API key can access resources of other operators.
- CVE-2026-49258High
Nebula Mesh versions 0.3.5 and below do not apply per-operator CA scoping in the web UI, allowing any authenticated non-admin operator to access resources belonging to other operators. This was partially fixed in GHSA-598g-h2vc-h5vg but the web UI was not covered.
- CVE-2026-48058Medium
nebula-mesh before version 0.3.2 sets HttpOnly and SameSite=Lax flags on cookies but never sets the Secure flag. A single plaintext request to the origin (e.g., operator on a LAN, mistyped URL, HTTP→HTTPS not strictly enforced, reverse proxy misconfiguration) discloses the session.
- CVE-2026-47768Medium
In nebula-mesh prior to version 0.3.2, a newly minted operator API key was exposed in the redirect URL, potentially leaking via Referer header, browser history, or proxy logs. This issue has been fixed in version 0.3.2.
- CVE-2026-47726High
nebula-mesh versions prior to 0.3.2 do not perform admin checks on the audit log endpoint. Any operator with an API key can read the full audit log, including cross-tenant data.
- CVE-2026-48025Medium
In nebula-mesh prior to version 0.3.7, decrypted CA private keys remain in the process heap after use because they are not zeroed before memory release. This violates the keystore package contract and could lead to key leakage. This issue has been fixed in version 0.3.7.
- CVE-2026-47723High
In nebula-mesh before version 0.3.1, standard browser security headers (Content-Security-Policy, X-Frame-Options, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy) are missing in the internal/web/ and internal/api/ response paths. Fixed in version 0.3.1.
- CVE-2026-47722High
In nebula-mesh before version 0.3.2, in internal/configgen/generator.go, the ListenHost and TunDevice fields are interpolated without validation into a text/template, potentially leading to code injection. internal/web/advanced.go accepts these fields with only whitespace trimming, no character or shape validation.
Original NVD description (English source)
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/* POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits but does not protect: top-level form-submit navigations from third-party pages (some browsers still send Lax cookies on top-level POSTs); same-registrable-domain attackers (sibling-subdomain XSS, subdomain takeover); the GET /ui/logout route, which a third-party <img src=".../ui/logout"> can force-trigger. This issue has been patched in version 0.3.3.