Vulnerabilities

Filters

1 selected

9 records

Sort

Vendor: juev Clear all filters

TI-2026-36454 CVE-2026-49258 · GHSA-c6v2-3ffm-vcmc

Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)

MEDIUM 41

Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00481 Published 2026-07-28 Fixed in 0.3.6 CWE-639

TI-2026-35499 CVE-2026-48058 · GHSA-rqfj-vv8r-xhqc

nebula-mesh: Session and OIDC state cookies lack the Secure attribute

MEDIUM 54

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network.

CVSS 4.0MEDIUM 4.6 Network No auth No interaction EPSS 0.00246 Published 2026-07-28 Fixed in 0.3.2 CWE-614

TI-2026-35265 CVE-2026-47768 · GHSA-9pg3-25fq-p6cc

nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)

LOW 24

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00154 Published 2026-07-28 Fixed in 0.3.2 CWE-598

TI-2026-35227 CVE-2026-47726 · GHSA-qm33-p5p9-f8vg

nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator

MEDIUM 64

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00302 Published 2026-07-28 Fixed in 0.3.2 CWE-285

TI-2026-35226 CVE-2026-47725 · GHSA-273q-qgh5-wrj6

nebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpoints

HIGH 70

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00187 Published 2026-07-28 Fixed in 0.3.3 CWE-352

TI-2026-35468 CVE-2026-48025 · GHSA-8h84-fhqq-q58v

nebula-mesh: Decrypted CA private key persists in heap after signing

LOW 37

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00507 Published 2026-07-28 Fixed in 0.3.7 CWE-244

TI-2026-35225 CVE-2026-47724 · GHSA-598g-h2vc-h5vg

nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation

MEDIUM 43

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00481 Published 2026-07-23 Fixed in 0.3.4 CWE-862

TI-2026-35224 CVE-2026-47723 · GHSA-w7w5-5gcp-38rw

nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)

LOW 32

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00526 Published 2026-07-23 Fixed in 0.3.1 CWE-1021

TI-2026-35223 CVE-2026-47722 · GHSA-7hp6-g3pq-3pc3

nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml

MEDIUM 40

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00467 Published 2026-07-23 Fixed in 0.3.2 CWE-94