CVE-2026-53603

Received Received - Intake

Session Token Exposure in Nebula-Mesh VPN Control Plane

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: GitHub, Inc.

Description

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintext in the operator_sessions table (the token column is the PRIMARY KEY). The session token is a 32-byte random hex value sent directly in a cookie and valid for 24 hours. Anyone who can read the database (backup, snapshot, file copy, or SQL-level disclosure) obtains every active session token and can hijack operator sessions directly, with no further authentication. This issue has been patched in version 0.3.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-04

Last Modified

2026-09-04

Generated

2026-09-05

AI Q&A

2026-09-05

EPSS Evaluated

N/A

NVD

CVE-2026-53603

Affected Vendors & Products

Vendor	Product	Version / Range
nebula-mesh	nebula_mesh	to 0.3.8 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CWE-312	The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

Executive Summary

The vulnerability in nebula-mesh versions prior to 0.3.8 involves storing operator session tokens in plaintext within the database. These tokens are 32-byte random hex values sent directly in cookies and valid for 24 hours. An attacker who gains access to the database can read these tokens and hijack active operator sessions without further authentication.

Detection Guidance

Check the database for plaintext session tokens in the operator_sessions table. Look for the token column in the database file or during SQL queries. Verify if tokens are stored in plaintext rather than hashed.

Impact Analysis

If you use nebula-mesh before version 0.3.8, an attacker could exploit this to gain unauthorized access to your VPN control plane by stealing session tokens. This could allow them to impersonate operators, perform administrative actions, or access sensitive network resources.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. Storing session tokens in plaintext breaches confidentiality principles under GDPR and HIPAA, as it exposes sensitive authentication data. Organizations may face penalties for non-compliance due to inadequate security measures.

Mitigation Strategies

Upgrade to version 0.3.8 or later of nebula-mesh to patch the issue. Rotate all active session tokens immediately to prevent hijacking. Restrict database access to authorized personnel only.

Hi! I’m here to help you understand CVE-2026-53603. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70