{"id":"CVE-2026-49258","sourceIdentifier":"security-advisories@github.com","published":"2026-07-28T19:17:36.000","lastModified":"2026-10-23T23:10:00.157","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI (/ui/*) does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5vg, but the changes were not implemented in the web read/mutation surface. Any authenticated non-admin operator (for example, one created via self-registration or OIDC) can access resources belonging to other operators. The host create/edit/mobile-bundle/network-create paths and all CA-management routes were already correctly scoped. A malicious operator could block or delete any other operator's host, or read any operator's hosts and networks. This issue has been fixed in version 0.3.6."},{"lang":"es","value":"Nebula Mesh es un plano de control autoalojado para la VPN de malla Slack Nebula. En las versiones 0.3.5 e inferiores, la interfaz de usuario web (/ui/*) no aplica el alcance de CA por operador empleado por la API JSON. Esto fue abordado parcialmente por GHSA-598g-h2vc-h5vg, pero los cambios no fueron implementados en la superficie de lectura/mutación web. Cualquier operador autenticado no administrador (por ejemplo, uno creado mediante autorregistro u OIDC) puede acceder a recursos pertenecientes a otros operadores. Las rutas de creación/edición de host/paquete móvil/creación de red y todas las rutas de gestión de CA ya estaban correctamente delimitadas. Un operador malicioso podría bloquear o eliminar el host de cualquier otro operador, o leer los hosts y redes de cualquier operador. Este problema ha sido solucionado en la versión 0.3.6."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"juev","product":"nebula-mesh","versions":[{"version":"< 0.3.6","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-28T19:21:26.834734Z","id":"CVE-2026-49258","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/forgekeep/nebula-mesh/pull/161","source":"security-advisories@github.com"},{"url":"https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-c6v2-3ffm-vcmc","source":"security-advisories@github.com"}]}