CVE-2026-47726
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
nebula-mesh versions prior to 0.3.2 do not perform admin checks on the audit log endpoint. Any operator with an API key can read the full audit log, including cross-tenant data.
Risk Assessment
A tenant can gain insight into server activity, staffing patterns, and identify high-value targets, compromising confidentiality and enabling further attacks.
Recommendation
Immediately upgrade nebula-mesh to version 0.3.2, which includes the fix requiring admin privilege checks.
Other vulnerabilities in nebula-mesh
See all- CVE-2026-47724Critical
Vulnerability in nebula-mesh allows privilege escalation due to missing access controls on many API endpoints. Any operator with an API key can access resources of other operators.
- CVE-2026-49258High
Nebula Mesh versions 0.3.5 and below do not apply per-operator CA scoping in the web UI, allowing any authenticated non-admin operator to access resources belonging to other operators. This was partially fixed in GHSA-598g-h2vc-h5vg but the web UI was not covered.
- CVE-2026-48058Medium
nebula-mesh before version 0.3.2 sets HttpOnly and SameSite=Lax flags on cookies but never sets the Secure flag. A single plaintext request to the origin (e.g., operator on a LAN, mistyped URL, HTTP→HTTPS not strictly enforced, reverse proxy misconfiguration) discloses the session.
- CVE-2026-47768Medium
In nebula-mesh prior to version 0.3.2, a newly minted operator API key was exposed in the redirect URL, potentially leaking via Referer header, browser history, or proxy logs. This issue has been fixed in version 0.3.2.
- CVE-2026-47725Medium
In nebula-mesh prior to version 0.3.3, all /ui/* POST/PUT/PATCH/DELETE routes process requests immediately after session cookie validation. SameSite=Lax does not protect against cross-site form submissions from third-party domains (e.g., top-level navigations, sibling-subdomain attacks) or against the GET /ui/logout route. This issue has been fixed in version 0.3.3.
- CVE-2026-48025Medium
In nebula-mesh prior to version 0.3.7, decrypted CA private keys remain in the process heap after use because they are not zeroed before memory release. This violates the keystore package contract and could lead to key leakage. This issue has been fixed in version 0.3.7.
- CVE-2026-47723High
In nebula-mesh before version 0.3.1, standard browser security headers (Content-Security-Policy, X-Frame-Options, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy) are missing in the internal/web/ and internal/api/ response paths. Fixed in version 0.3.1.
- CVE-2026-47722High
In nebula-mesh before version 0.3.2, in internal/configgen/generator.go, the ListenHost and TunDevice fields are interpolated without validation into a text/template, potentially leading to code injection. internal/web/advanced.go accepts these fields with only whitespace trimming, no character or shape validation.
Original NVD description (English source)
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via store.ListAuditEntries (up to limit=1000). This includes cross-tenant actor names, host/CA/operator IDs, action timestamps, and masked-IP entries from rate-limit refusals — enough surface for a tenant to enumerate the server's activity, infer staffing patterns, or identify high-value targets. This issue has been patched in version 0.3.2.