- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 11 · 1 critical, 4 high, 6 medium
- Registry
- pkg.go.dev
Advisories 11
- CVE-2026-55513Medium 5.4
nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens
Affected: from 0.3.0.
- CVE-2026-55512Medium 5.3
nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting
Affected: from 0.2.0.
- CVE-2026-49258High 8.8
Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)
Affected: through 0.3.4; all versions.
- CVE-2026-48058Medium 4.6
nebula-mesh: Session and OIDC state cookies lack the Secure attribute
Affected: fixed in 0.3.2.
- CVE-2026-47768Medium 5.5
nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)
Affected: fixed in 0.3.2.
- CVE-2026-47726High 7.1
nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator
Affected: fixed in 0.3.2.
- CVE-2026-47725Medium 6.9
nebula-mesh: Web UI lacks CSRF tokens on /ui/ mutating endpoints
Affected: fixed in 0.3.3.
- CVE-2026-48025Medium 6.9
nebula-mesh: Decrypted CA private key persists in heap after signing
Affected: fixed in 0.3.7.
- CVE-2026-47724Critical 9.9
nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation
Affected: fixed in 0.3.4.
- CVE-2026-47723High 7.1
nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)
Affected: fixed in 0.3.1.
- CVE-2026-47722High 8.7
nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml
Affected: fixed in 0.3.2.