Vulnerabilities

TI-2026-45231 CVE-2026-63464

Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`

HIGH 67

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00464 Published 2026-09-04 Fixed in 0.7.2 CWE-862

TI-2026-44169 CVE-2026-61699 · GHSA-cm26-5974-52h8

HIGH 70

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00446 Published 2026-09-04 Fixed in 0.7.1 CWE-299

TI-2026-40059 CVE-2026-55513 · GHSA-g4x6-jcvr-9m3g

MEDIUM 58

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.0032 Published 2026-09-04 Fixed in 0.5.0 CWE-613

TI-2026-40058 CVE-2026-55512 · GHSA-m3cx-mwpg-32jg

MEDIUM 63

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00597 Published 2026-09-04 Fixed in 0.5.0 CWE-400

TI-2026-38660 CVE-2026-53604 · GHSA-2p2f-px33-4vv5

LOW 30

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00184 Published 2026-09-04 Fixed in 0.3.8 CWE-212

TI-2026-38659 CVE-2026-53603 · GHSA-q4vm-pq3q-8wgq

LOW 37

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00352 Published 2026-09-04 Fixed in 0.3.8 CWE-312

TI-2026-38658 CVE-2026-53602 · GHSA-339v-266x-79xr

LOW 30

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00309 Published 2026-09-04 Fixed in 0.3.7 CWE-285