CVE-2026-47723

Received Received - Intake

Missing Security Headers in Nebula-Mesh Control Plane

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: GitHub, Inc.

Description

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in `internal/web/` or `internal/api/` set the standard browser-security headers. `grep` for `Content-Security-Policy`, `X-Frame-Options`, `Strict-Transport-Security`, `X-Content-Type-Options`, `Referrer-Policy` returns zero matches across the codebase. Version 0.3.1 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-23

Last Modified

2026-07-23

Generated

2026-07-24

AI Q&A

2026-07-24

EPSS Evaluated

N/A

NVD

CVE-2026-47723

Affected Vendors & Products

Vendor	Product	Version / Range
nebula-mesh	nebula-mesh	to 0.3.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1021	The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.

Attack-Flow Graph

Executive Summary

The vulnerability in nebula-mesh (prior to version 0.3.1) involves missing standard browser-security headers in response paths. This includes headers like Content-Security-Policy, X-Frame-Options, Strict-Transport-Security, X-Content-Type-Options, and Referrer-Policy, which are crucial for protecting against common web attacks such as clickjacking, cross-site scripting, and MIME-type sniffing.

Detection Guidance

Check if the nebula-mesh service is running and inspect its HTTP response headers for missing security headers like Content-Security-Policy, X-Frame-Options, Strict-Transport-Security, X-Content-Type-Options, and Referrer-Policy. Use curl to query the service and review headers.

Impact Analysis

This vulnerability could expose users to various web-based attacks. Without these headers, attackers might exploit weaknesses to perform actions on behalf of users, steal sensitive data, or manipulate web page content. The impact depends on the specific use of nebula-mesh in your environment.

Compliance Impact

Missing security headers may lead to non-compliance with GDPR, HIPAA, or other regulations that require protection of user data and secure communication. These headers help enforce security policies that are often mandated by such standards, so their absence could result in violations.

Mitigation Strategies

Upgrade nebula-mesh to version 0.3.1 or later, which includes fixes for missing security headers. Ensure all web and API endpoints are updated and verify the headers are now present in responses.

Hi! I’m here to help you understand CVE-2026-47723. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70