nebula-mesh: Session and OIDC state cookies lack the Secure attribute

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-48058 · Microsoft / collected KEV context

GHSA-rqfj-vv8r-xhqc

GO-2026-5635

cve-program · CVE-2026-48058

• https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-rqfj-vv8r-xhqc
• https://github.com/forgekeep/nebula-mesh/commit/ffdd67dbf221d9a5855c39fbe11b49c245048d85
• https://github.com/forgekeep/nebula-mesh/releases/tag/v0.3.2

nvd · CVE-2026-48058

• https://github.com/forgekeep/nebula-mesh/commit/ffdd67dbf221d9a5855c39fbe11b49c245048d85
• https://github.com/forgekeep/nebula-mesh/releases/tag/v0.3.2
• https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-rqfj-vv8r-xhqc

osv · GHSA-rqfj-vv8r-xhqc

• https://github.com/juev/nebula-mesh/security/advisories/GHSA-rqfj-vv8r-xhqc
• https://github.com/forgekeep/nebula-mesh/commit/ffdd67dbf221d9a5855c39fbe11b49c245048d85
• https://github.com/juev/nebula-mesh

osv · GO-2026-5635

• https://github.com/juev/nebula-mesh/security/advisories/GHSA-rqfj-vv8r-xhqc
• https://github.com/forgekeep/nebula-mesh/commit/ffdd67dbf221d9a5855c39fbe11b49c245048d85

No related operational record is retained in the current change model.