CVE-2026-47725
Received Received - Intake

Session Cookie Validation Bypass in Nebula-Mesh

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/* POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits but does not protect: top-level form-submit navigations from third-party pages (some browsers still send Lax cookies on top-level POSTs); same-registrable-domain attackers (sibling-subdomain XSS, subdomain takeover); the GET /ui/logout route, which a third-party <img src=".../ui/logout"> can force-trigger. This issue has been patched in version 0.3.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-29
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-47725
EUVD
EUVD-2026-49939

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
nebula-mesh nebula_mesh to 0.3.3 (exc)
forgekeep nebula-mesh to 0.3.3 (exc)
forgekeep nebula-mesh 0.3.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) flaw in nebula-mesh versions up to 0.3.2. It allows attackers to trick authenticated users into submitting malicious requests to endpoints under /ui/* by bypassing SameSite=Lax cookie protections. The issue occurs because these endpoints process requests immediately after session cookie validation without additional CSRF checks.

Detection Guidance

Check if your nebula-mesh instance is running a version prior to 0.3.3. Inspect network traffic for POST/PUT/PATCH/DELETE requests to /ui/* endpoints without CSRF tokens. Look for suspicious logout requests triggered by image tags or unauthorized actions like CA deletions.

Impact Analysis

An attacker could exploit this to perform privileged actions like deleting certificates, minting API keys, or changing server settings without user consent. They might trick you into visiting a malicious link or submitting a form, leading to unauthorized changes or forced logouts via image tags.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA due to insufficient CSRF protection allowing unauthorized privileged actions. GDPR requires data processing integrity and security, while HIPAA mandates access controls and audit mechanisms. The lack of CSRF protection may enable unauthorized changes to server settings, CA certificates, or API keys, compromising data integrity and access controls.

Mitigation Strategies

Upgrade nebula-mesh to version 0.3.3 or later. Implement double-submit cookie CSRF protection with a 32-byte token. Change the /ui/logout endpoint to POST method. Rotate CSRF tokens during login, OIDC auth, 2FA completion, and logout. Ensure tokens are validated for all mutating endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47725. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart