CVE-2026-63464
Received Received - Intake

SSRF Bypass via allow_private in Nebula-Mesh

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: GitHub, Inc.

Description
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators (role user) can set allow_private: true on their own managed webhook subscription (POST/PATCH /api/v1/webhook-subscriptions). No admin check exists on this field. At delivery time, allow_private switches the dispatcher to an unguarded HTTP client, bypassing the private/loopback/link-local SSRF guard — letting a low-privilege operator make the server request internal addresses. This issue has been patched in version 0.7.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-63464
EUVD
EUVD-2026-71721

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nebula_mesh nebula_mesh From 0.6.0 (inc) to 0.7.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in nebula-mesh allows non-admin users to set a flag called allow_private to true on their webhook subscriptions. This bypasses security checks that normally prevent requests to internal or restricted addresses, potentially allowing these users to make the server send requests to internal systems it should not access.

Detection Guidance

To detect this vulnerability, check if your nebula-mesh instance is running a version between 0.6.0 and 0.7.1. Inspect webhook subscription configurations for the allow_private field set to true by non-admin operators. Review server logs for internal HTTP requests originating from the mesh control plane.

Impact Analysis

If exploited, this vulnerability could let an attacker with limited access (non-admin role) trick the server into sending requests to internal network addresses. This might expose sensitive internal services or data, leading to unauthorized access or data leaks within your network.

Compliance Impact

This vulnerability could lead to unauthorized access to internal systems or data, violating compliance requirements for data protection and access control under standards like GDPR and HIPAA. It may result in data breaches or unauthorized exposure of sensitive information.

Mitigation Strategies

Upgrade nebula-mesh to version 0.7.2 or later immediately. Remove or correct any allow_private: true settings in webhook subscriptions created by non-admin operators. Audit all webhook configurations for unauthorized private network access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63464. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart