Read the docs
TI-2026-38659 Aliases CVE-2026-53603GHSA-q4vm-pq3q-8wgq

nebula-mesh: Operator session tokens stored in plaintext in the database

Priority LOW 37CWE-312Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-312.

Summary

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintext in the operator_sessions table (the token column is the PRIMARY KEY). The session token is a 32-byte random hex value sent directly in a cookie and valid for 24 hours. Anyone who can read the database (backup, snapshot, file copy, or SQL-level disclosure) obtains every active session token and can hijack operator sessions directly, with no further authentication. This issue has been patched in version 0.3.8.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00352 29th percentileScored 2026-11-07
Fix Fixed nebula-mesh (forgekeep): 0.3.8github.com/forgekeep/nebula-mesh (Go): 0.3.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
forgekeepnebula-meshbefore 0.3.80.3.8Patch availableCNA
—github.com/forgekeep/nebula-mesh (Go)before 0.3.80.3.8Patch availableGHSA-q4vm-pq3q-8wgq
  • nebula-mesh Vendorforgekeep Affected before 0.3.8 Fixed in 0.3.8 Patch available CNA
  • github.com/forgekeep/nebula-mesh (Go) Vendor— Affected before 0.3.8 Fixed in 0.3.8 Patch available GHSA-q4vm-pq3q-8wgq

Remediation

  • Fix · CNA nebula-mesh (forgekeep) Fixed in 0.3.8
  • Fix · GHSA-q4vm-pq3q-8wgq github.com/forgekeep/nebula-mesh (Go) Fixed in 0.3.8 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53603
  2. 2026-10-03 Alias added: GHSA-q4vm-pq3q-8wgq

References

Other 4

  • TI-2026-44169 nebula-mesh: Certificate revocation is never enforced at the mesh CVSS 3.1HIGH 8.1
  • TI-2026-45231 Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private` CVSS 3.1HIGH 7.7
  • TI-2026-40058 nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting CVSS 3.1MEDIUM 5.3
  • TI-2026-40059 nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens CVSS 3.1MEDIUM 5.4
  • TI-2026-38660 nebula-mesh: CA private key not zeroized on web mobile-bundle error paths CVSS 4.0HIGH 7.1
  • TI-2026-38658 nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences