CVE-2026-47724

Received Received - Intake

Authorization Bypass in Nebula-Mesh API Endpoints

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: GitHub, Inc.

Description

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the `/api/v1/*` route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at `internal/api/hosts.go:384`: "API trusts the bearer token for authorisation; per-CA ownership is enforced only in the Web layer." The Web UI gates state-changing routes through `loadAccessibleCA` (`internal/web/cas.go`); CA-management endpoints in `internal/api/cas.go` ALSO have proper `canAccessCA` gates. The gap is on the host, network, firewall, mobile-bundle, and most operator endpoints. Combined with the per-operator CA model from ADR 0002, this gives any non-admin operator API key broad cross-tenant access — instant privilege escalation in the worst case. Version 0.3.4 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-23

Last Modified

2026-07-23

Generated

2026-07-24

AI Q&A

2026-07-24

EPSS Evaluated

N/A

NVD

CVE-2026-47724

Affected Vendors & Products

Vendor	Product	Version / Range
nebula_mesh	nebula_mesh	to 0.3.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is in nebula-mesh, a self-hosted control plane for Slack Nebula VPN. Prior to version 0.3.4, most API endpoints under /api/v1/* only checked the bearer token for authorization, trusting it alone to grant access. This allowed non-admin operators with API keys to perform actions across different tenants, leading to privilege escalation.

Detection Guidance

Check API endpoints for improper authorization by reviewing logs for unauthorized access attempts to /api/v1/* routes. Inspect bearer token validation logic in the codebase, particularly in internal/api/hosts.go and internal/api/cas.go. Verify if non-admin operator API keys have cross-tenant access.

Impact Analysis

If you use nebula-mesh before version 0.3.4, an attacker with a non-admin operator API key could gain unauthorized access to sensitive data or perform actions across multiple tenants. This could lead to data breaches, unauthorized modifications, or complete system compromise depending on the privileges of the compromised account.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by allowing unauthorized access to sensitive data. GDPR requires strict access controls and data protection, while HIPAA mandates safeguards to ensure confidentiality and integrity of health information. The lack of proper authorization could result in non-compliance and potential legal penalties.

Mitigation Strategies

Upgrade to version 0.3.4 or later of nebula-mesh to fix the authorization flaw. Review and restrict API key permissions to ensure least privilege. Implement additional authorization checks for /api/v1/* endpoints beyond bearer token validation.

Hi! I’m here to help you understand CVE-2026-47724. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70