CVE-2026-49258
Received Received - Intake

Unauthorized Access to Operator Resources in Nebula Mesh

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description
Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI (/ui/*) does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5vg, but the changes were not implemented in the web read/mutation surface. Any authenticated non-admin operator (for example, one created via self-registration or OIDC) can access resources belonging to other operators. The host create/edit/mobile-bundle/network-create paths and all CA-management routes were already correctly scoped. A malicious operator could block or delete any other operator's host, or read any operator's hosts and networks. This issue has been fixed in version 0.3.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-29
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-49258
EUVD
EUVD-2026-49992

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
nebula_mesh nebula_mesh to 0.3.6 (exc)
forgekeep nebula_mesh to 0.3.5 (exc)
forgekeep nebula_mesh to 0.3.6 (exc)
forgekeep nebula_mesh 0.3.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Nebula Mesh versions 0.3.5 and below have a flaw in the web UI where ownership checks for resources are not properly enforced. Unlike the JSON API, the web UI does not apply per-operator CA scoping, allowing authenticated non-admin operators to access, modify, or delete resources belonging to other operators. This includes blocking hosts, deleting hosts, or reading sensitive data like host names, IPs, and certificates.

Detection Guidance

Check Nebula Mesh version with: curl -s http://<target>/api/version or nebula-mesh --version. Inspect web UI handlers for host edit/update/mobile-bundle routes. Verify if non-admin operators can access other operators' resources via UI or API endpoints.

Impact Analysis

If you are a non-admin operator in Nebula Mesh versions 0.3.5 or below, an attacker with similar privileges could exploit this to access your resources. If you are an admin, your operators' data could be exposed or modified. The impact includes unauthorized data access, data deletion, service disruption, and potential privilege escalation.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information. It may result in data breaches, non-compliance penalties, and loss of trust in systems handling regulated data.

Mitigation Strategies

Upgrade Nebula Mesh to version 0.3.6 or later. Review and restrict non-admin operator permissions. Monitor for unauthorized access attempts to host or network resources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49258. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart