{"id":"CVE-2026-47724","sourceIdentifier":"security-advisories@github.com","published":"2026-07-23T21:17:04.477","lastModified":"2026-10-24T13:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the `/api/v1/*` route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at `internal/api/hosts.go:384`: \"API trusts the bearer token for authorisation; per-CA ownership is enforced only in the Web layer.\" The Web UI gates state-changing routes through `loadAccessibleCA` (`internal/web/cas.go`); CA-management endpoints in `internal/api/cas.go` ALSO have proper `canAccessCA` gates. The gap is on the host, network, firewall, mobile-bundle, and most operator endpoints. Combined with the per-operator CA model from ADR 0002, this gives any non-admin operator API key broad cross-tenant access — instant privilege escalation in the worst case. Version 0.3.4 fixes the issue."},{"lang":"es","value":"nebula-mesh es un plano de control autohospedado para la red privada virtual de malla Slack Nebula. Antes de la versión 0.3.4, la superficie de ruta ’/api/v1/*’ confía únicamente en el token de portador para la autorización en la mayoría de los puntos finales. El propio código fuente admite esto en “internal/api/hosts.go:384”: ’La API confía en el token de portador para la autorización; la propiedad por CA se aplica solo en la capa web.’ La interfaz de usuario web protege las rutas que cambian de estado a través de “loadAccessibleCA” (“internal/web/cas.go”); los puntos finales de gestión de CA en “internal/api/cas.go” TAMBIÉN tienen puertas “canAccessCA” adecuadas. La brecha está en los puntos finales de host, red, cortafuegos, paquete móvil y la mayoría de los operadores. Combinado con el modelo de CA por operador de ADR 0002, esto otorga a cualquier clave API de operador no administrador un amplio acceso entre inquilinos - escalada de privilegios instantánea en el peor de los casos. La versión 0.3.4 soluciona el problema."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"juev","product":"nebula-mesh","versions":[{"version":"< 0.3.4","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-28T14:29:11.247252Z","id":"CVE-2026-47724","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/forgekeep/nebula-mesh/commit/9d8bcd7667ecd0c2975cc71fb35a02fe131f76f2","source":"security-advisories@github.com"},{"url":"https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-598g-h2vc-h5vg","source":"security-advisories@github.com"}]}