CVE-2026-47726
Received Received - Intake

Information Disclosure in Nebula-Mesh

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via store.ListAuditEntries (up to limit=1000). This includes cross-tenant actor names, host/CA/operator IDs, action timestamps, and masked-IP entries from rate-limit refusals — enough surface for a tenant to enumerate the server's activity, infer staffing patterns, or identify high-value targets. This issue has been patched in version 0.3.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-29
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-47726
EUVD
EUVD-2026-49942

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
nebula-mesh nebula_mesh to 0.3.2 (exc)
forgekeep nebula_mesh to 0.3.2 (exc)
forgekeep nebula_mesh 0.3.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-47726 is a vulnerability in nebula-mesh versions before 0.3.2 where the /api/v1/audit-log endpoint exposes all audit logs to any authenticated operator. The handleGetAuditLog function lacks an admin check, allowing any bearer-authenticated API key to retrieve sensitive data such as cross-tenant actor names, host/CA/operator IDs, timestamps, and masked-IP entries.

Detection Guidance

Check if your Nebula Mesh instance is running a vulnerable version (<= 0.3.1) by running: nebula-mesh version. Inspect API logs for unauthorized access to /api/v1/audit-log by filtering for GET requests with 200 status codes from non-admin users.

Impact Analysis

An attacker with an operator API key could access the full audit log, enabling them to enumerate server activity, infer staffing patterns, or identify high-value targets. This could lead to information leakage, targeted attacks, or further exploitation of the system.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access controls. It exposes sensitive audit data, which could include personally identifiable information or operational details, leading to potential violations of GDPR, HIPAA, or other privacy regulations.

Mitigation Strategies

Upgrade Nebula Mesh to version 0.3.2 or later immediately. Review API keys and revoke any unnecessary operator access. Implement additional monitoring for audit log access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47726. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart