CVE-2026-48058
Received Received - Intake

Session Cookie Exposure in Nebula-Mesh

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin (operator on a LAN, mistyped URL, HTTP→HTTPS not strictly enforced, reverse proxy misconfiguration) discloses the session. This issue has been patched in version 0.3.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-29
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-48058
EUVD
EUVD-2026-49991

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
nebula_mesh nebula_mesh to 0.3.2 (exc)
forgekeep nebula_mesh to 0.3.2 (exc)
forgekeep nebula_mesh 0.3.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-614 The Secure attribute for sensitive cookies in HTTPS sessions is not set.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in nebula-mesh (CVE-2026-48058) involves session and OIDC state cookies lacking the Secure attribute. This means cookies are sent in plaintext over HTTP, allowing interception if an attacker observes an unencrypted request. The issue affects versions up to v0.3.0 and was patched in v0.3.2.

Detection Guidance

Check if cookies are transmitted without the Secure flag by inspecting HTTP traffic. Use tools like Wireshark or tcpdump to capture plaintext HTTP requests containing session cookies. Verify cookie attributes in browser developer tools or via curl commands checking response headers for 'Set-Cookie' fields missing 'Secure'.

Impact Analysis

An attacker could recover the session cookie and impersonate the operator for 24 hours or exploit the OIDC state cookie for CSRF within 10 minutes. This could lead to unauthorized access to the system or actions performed on behalf of the user.

Compliance Impact

The lack of Secure attribute on session cookies exposes sensitive data in plaintext over HTTP, violating GDPR's requirement for secure transmission of personal data (Article 32) and HIPAA's Security Rule for transmission security (45 CFR § 164.312(e)). Unauthorized interception of session cookies could lead to unauthorized access to protected health information or personal data.

Mitigation Strategies

Upgrade nebula-mesh to version 0.3.2 or later. Enable the cookie_secure option and set it to true if TLS is configured. Ensure TLS is enforced and misconfigured HTTP→HTTPS redirects are corrected. Perform a one-time logout after enabling Secure cookies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48058. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart