- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 8 · 4 high, 4 medium
- Registry
- pkg.go.dev
Advisories 8
- CVE-2026-63464High 7.7
Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`
Affected: from 0.6.0, fixed in 0.7.2.
- CVE-2026-61699High 8.1
nebula-mesh: Certificate revocation is never enforced at the mesh
Affected: fixed in 0.7.1.
- CVE-2026-55513Medium 5.4
nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens
Affected: from 0.3.0, fixed in 0.5.0; from 0.4.0, fixed in 0.5.0.
- CVE-2026-55512Medium 5.3
nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting
Affected: from 0.2.0, fixed in 0.5.0; from 0.4.0, fixed in 0.5.0.
- CVE-2026-53604High 7.1
nebula-mesh: CA private key not zeroized on web mobile-bundle error paths
Affected: fixed in 0.3.8.
- CVE-2026-53603High 7.1
nebula-mesh: Operator session tokens stored in plaintext in the database
Affected: fixed in 0.3.8.
- CVE-2026-53602Medium 6.9
nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate
Affected: fixed in 0.3.7.
- CVE-2026-48025Medium 6.9
nebula-mesh: Decrypted CA private key persists in heap after signing
Affected: fixed in 0.3.7.