Read the docs
TI-2026-36454 Aliases CVE-2026-49258GHSA-c6v2-3ffm-vcmc

Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)

Priority MEDIUM 41CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI (/ui/*) does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5vg, but the changes were not implemented in the web read/mutation surface. Any authenticated non-admin operator (for example, one created via self-registration or OIDC) can access resources belonging to other operators. The host create/edit/mobile-bundle/network-create paths and all CA-management routes were already correctly scoped. A malicious operator could block or delete any other operator's host, or read any operator's hosts and networks. This issue has been fixed in version 0.3.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00481 41st percentileScored 2026-11-07
Fix Fixed nebula-mesh (juev): 0.3.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
juevnebula-meshbefore 0.3.60.3.6Patch availableCNA
—github.com/juev/nebula-mesh (Go)up to 0.3.4—No fix listedGHSA-c6v2-3ffm-vcmc
  • nebula-mesh Vendorjuev Affected before 0.3.6 Fixed in 0.3.6 Patch available CNA
  • github.com/juev/nebula-mesh (Go) Vendor— Affected up to 0.3.4 Fixed in — No fix listed GHSA-c6v2-3ffm-vcmc

Remediation

  • Fix · CNA nebula-mesh (juev) Fixed in 0.3.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49258
  2. 2026-10-03 Alias added: GHSA-c6v2-3ffm-vcmc

References

Other 4

  • TI-2026-35226 nebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpoints CVSS 4.0MEDIUM 6.9
  • TI-2026-35227 nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator CVSS 4.0HIGH 7.1
  • TI-2026-35499 nebula-mesh: Session and OIDC state cookies lack the Secure attribute CVSS 4.0MEDIUM 4.6
  • TI-2026-35225 nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation CVSS 3.1CRITICAL 9.9
  • TI-2026-35223 nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml CVSS 4.0HIGH 8.7
  • TI-2026-35468 nebula-mesh: Decrypted CA private key persists in heap after signing CVSS 4.0MEDIUM 6.9
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences