forgekeep/nebula-mesh Security Advisories | GitStock

high2026-07-14

Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`

GHSA-7rx3-5wx3-5v76

high2026-07-14

nebula-mesh: Certificate revocation is never enforced at the mesh

GHSA-cm26-5974-52h8 · CVE-2026-61699

medium2026-07-14

nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens

GHSA-g4x6-jcvr-9m3g · CVE-2026-55513

medium2026-07-14

nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting

GHSA-m3cx-mwpg-32jg · CVE-2026-55512

high2026-07-14

nebula-mesh: Operator session tokens stored in plaintext in the database

GHSA-q4vm-pq3q-8wgq · CVE-2026-53603

high2026-07-14

nebula-mesh: CA private key not zeroized on web mobile-bundle error paths

GHSA-2p2f-px33-4vv5 · CVE-2026-53604

medium2026-07-09

nebula-mesh: Host revocation is not durable - blocked/offboarded hosts can regain a valid certificate

GHSA-339v-266x-79xr · CVE-2026-53602