Read the docs
TI-2026-40058 Aliases CVE-2026-55512GHSA-m3cx-mwpg-32jg

nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting

Priority MEDIUM 63CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.2.0 to before version 0.5.0, when OIDC is enabled, GET /ui/oidc/login is reachable without authentication and is registered outside the Web UI rate-limited auth routes. Every request creates a fresh random OIDC state value and stores it in an in-memory map for 10m. Expired states are swept lazily, but there is no rate limit or maximum live-state cap on the allocation path. An unauthenticated remote client can therefore grow OIDC.states for the full state TTL, bounded by request throughput rather than by configured auth rate limits. This issue has been patched in version 0.5.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00597 48th percentileScored 2026-11-07
Fix Fixed nebula-mesh (forgekeep): 0.5.0github.com/forgekeep/nebula-mesh (Go): 0.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
forgekeepnebula-mesh0.2.0 to before 0.5.00.5.0Patch availableCNA
—github.com/forgekeep/nebula-mesh (Go)0.2.0 to before 0.5.00.5.0Patch availableGHSA-m3cx-mwpg-32jg
  • nebula-mesh Vendorforgekeep Affected 0.2.0 to before 0.5.0 Fixed in 0.5.0 Patch available CNA
  • github.com/forgekeep/nebula-mesh (Go) Vendor— Affected 0.2.0 to before 0.5.0 Fixed in 0.5.0 Patch available GHSA-m3cx-mwpg-32jg

Remediation

  • Fix · CNA nebula-mesh (forgekeep) Fixed in 0.5.0
  • Fix · GHSA-m3cx-mwpg-32jg github.com/forgekeep/nebula-mesh (Go) Fixed in 0.5.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55512
  2. 2026-10-03 Alias added: GHSA-m3cx-mwpg-32jg

References

Other 4

  • TI-2026-44169 nebula-mesh: Certificate revocation is never enforced at the mesh CVSS 3.1HIGH 8.1
  • TI-2026-45231 Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private` CVSS 3.1HIGH 7.7
  • TI-2026-40059 nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens CVSS 3.1MEDIUM 5.4
  • TI-2026-38659 nebula-mesh: Operator session tokens stored in plaintext in the database CVSS 4.0HIGH 7.1
  • TI-2026-38660 nebula-mesh: CA private key not zeroized on web mobile-bundle error paths CVSS 4.0HIGH 7.1
  • TI-2026-38658 nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences