CVE-2026-47768
Received Received - Intake

Operator API Key Exposure via Redirect URL in Nebula-Mesh

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs). This issue has been patched in version 0.3.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-29
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-47768
EUVD
EUVD-2026-49956

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nebula-mesh nebula-mesh to 0.3.2 (exc)
forgekeep nebula_mesh to 0.3.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-598 The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in nebula-mesh (versions <= 0.3.1) involves the exposure of newly generated operator API keys through the URL in a redirect response. When an administrator creates an API key via the /ui/operators/<id>/api-keys endpoint, the system issues a 303 redirect containing the raw API key as a query parameter. This exposes the token in browser history, Referer headers, proxy logs, and structured logging systems.

Detection Guidance

Check web server and proxy access logs for URLs containing '/ui/operators/' followed by 'new_key=' query parameters. Inspect browser history or Referer headers for exposed API keys in redirect responses.

Impact Analysis

If an attacker gains access to logs or browser history, they could steal the exposed API key. This could allow unauthorized access to the Nebula Mesh control plane, potentially compromising the VPN infrastructure. The impact is limited to systems where logs or browser data are accessible to untrusted parties.

Compliance Impact

This vulnerability could violate compliance requirements for data protection (e.g., GDPR, HIPAA) by exposing sensitive authentication credentials in logs or browser data. Unauthorized access to API keys may lead to breaches of confidentiality or integrity, triggering regulatory reporting obligations and potential fines.

Mitigation Strategies

Upgrade nebula-mesh to version 0.3.2 or later. Avoid using GET requests for sensitive operations like API key generation. Review and sanitize logs for exposed keys.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47768. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart