# github.com/juev/nebula-mesh (Go) vulnerabilities

11 known vulnerabilities (1 critical, 4 high, 6 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pkg.go.dev/github.com/juev/nebula-mesh

## Advisories (11)

### [CVE-2026-55513](https://cve.now/CVE-2026-55513): nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens

- Severity: Medium 5.4
- Published: Sep 4, 2026
- Affected: from 0.3.0.

### [CVE-2026-55512](https://cve.now/CVE-2026-55512): nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting

- Severity: Medium 5.3
- Published: Sep 4, 2026
- Affected: from 0.2.0.

### [CVE-2026-49258](https://cve.now/CVE-2026-49258): Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)

- Severity: High 8.8
- Published: Jul 28, 2026
- Affected: through 0.3.4; all versions.

### [CVE-2026-48058](https://cve.now/CVE-2026-48058): nebula-mesh: Session and OIDC state cookies lack the Secure attribute

- Severity: Medium 4.6
- Published: Jul 28, 2026
- Affected: fixed in 0.3.2.

### [CVE-2026-47768](https://cve.now/CVE-2026-47768): nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)

- Severity: Medium 5.5
- Published: Jul 28, 2026
- Affected: fixed in 0.3.2.

### [CVE-2026-47726](https://cve.now/CVE-2026-47726): nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator

- Severity: High 7.1
- Published: Jul 28, 2026
- Affected: fixed in 0.3.2.

### [CVE-2026-47725](https://cve.now/CVE-2026-47725): nebula-mesh: Web UI lacks CSRF tokens on /ui/ mutating endpoints

- Severity: Medium 6.9
- Published: Jul 28, 2026
- Affected: fixed in 0.3.3.

### [CVE-2026-48025](https://cve.now/CVE-2026-48025): nebula-mesh: Decrypted CA private key persists in heap after signing

- Severity: Medium 6.9
- Published: Jul 28, 2026
- Affected: fixed in 0.3.7.

### [CVE-2026-47724](https://cve.now/CVE-2026-47724): nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation

- Severity: Critical 9.9
- Published: Jul 23, 2026
- Affected: fixed in 0.3.4.

### [CVE-2026-47723](https://cve.now/CVE-2026-47723): nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)

- Severity: High 7.1
- Published: Jul 23, 2026
- Affected: fixed in 0.3.1.

### [CVE-2026-47722](https://cve.now/CVE-2026-47722): nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml

- Severity: High 8.7
- Published: Jul 23, 2026
- Affected: fixed in 0.3.2.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/github.com/juev/nebula-mesh
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.