CVE-2026-49258Published
Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI (/ui/*) does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5…
Exact source revision recorded 25 Oct 2026 12:17:32 UTC. It does not establish the source's current position. Latest evidence.
nvd · CVE-2026-49258
PublishedNo affected-package array is stated in this source revision. Check its state and earlier observations; this does not establish that every package is unaffected.