CVE-2026-48058
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
nebula-mesh before version 0.3.2 sets HttpOnly and SameSite=Lax flags on cookies but never sets the Secure flag. A single plaintext request to the origin (e.g., operator on a LAN, mistyped URL, HTTP→HTTPS not strictly enforced, reverse proxy misconfiguration) discloses the session.
Risk Assessment
The organization is at risk of session hijacking via man-in-the-middle attacks, potentially leading to unauthorized access to the management panel.
Recommendation
Update nebula-mesh to version 0.3.2 or later and configure strict HTTPS enforcement on the server.
Other vulnerabilities in nebula-mesh
See all- CVE-2026-47724Critical
Vulnerability in nebula-mesh allows privilege escalation due to missing access controls on many API endpoints. Any operator with an API key can access resources of other operators.
- CVE-2026-49258High
Nebula Mesh versions 0.3.5 and below do not apply per-operator CA scoping in the web UI, allowing any authenticated non-admin operator to access resources belonging to other operators. This was partially fixed in GHSA-598g-h2vc-h5vg but the web UI was not covered.
- CVE-2026-47768Medium
In nebula-mesh prior to version 0.3.2, a newly minted operator API key was exposed in the redirect URL, potentially leaking via Referer header, browser history, or proxy logs. This issue has been fixed in version 0.3.2.
- CVE-2026-47726High
nebula-mesh versions prior to 0.3.2 do not perform admin checks on the audit log endpoint. Any operator with an API key can read the full audit log, including cross-tenant data.
- CVE-2026-47725Medium
In nebula-mesh prior to version 0.3.3, all /ui/* POST/PUT/PATCH/DELETE routes process requests immediately after session cookie validation. SameSite=Lax does not protect against cross-site form submissions from third-party domains (e.g., top-level navigations, sibling-subdomain attacks) or against the GET /ui/logout route. This issue has been fixed in version 0.3.3.
- CVE-2026-48025Medium
In nebula-mesh prior to version 0.3.7, decrypted CA private keys remain in the process heap after use because they are not zeroed before memory release. This violates the keystore package contract and could lead to key leakage. This issue has been fixed in version 0.3.7.
- CVE-2026-47723High
In nebula-mesh before version 0.3.1, standard browser security headers (Content-Security-Policy, X-Frame-Options, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy) are missing in the internal/web/ and internal/api/ response paths. Fixed in version 0.3.1.
- CVE-2026-47722High
In nebula-mesh before version 0.3.2, in internal/configgen/generator.go, the ListenHost and TunDevice fields are interpolated without validation into a text/template, potentially leading to code injection. internal/web/advanced.go accepts these fields with only whitespace trimming, no character or shape validation.
Original NVD description (English source)
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin (operator on a LAN, mistyped URL, HTTP→HTTPS not strictly enforced, reverse proxy misconfiguration) discloses the session. This issue has been patched in version 0.3.2.