{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47724", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-19T21:29:25.482Z", "datePublished": "2026-07-23T20:20:59.494Z", "dateUpdated": "2026-07-23T20:20:59.494Z"}, "containers": {"cna": {"title": "nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-598g-h2vc-h5vg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-598g-h2vc-h5vg"}, {"name": "https://github.com/forgekeep/nebula-mesh/commit/9d8bcd7667ecd0c2975cc71fb35a02fe131f76f2", "tags": ["x_refsource_MISC"], "url": "https://github.com/forgekeep/nebula-mesh/commit/9d8bcd7667ecd0c2975cc71fb35a02fe131f76f2"}], "affected": [{"vendor": "juev", "product": "nebula-mesh", "versions": [{"version": "< 0.3.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-23T20:20:59.494Z"}, "descriptions": [{"lang": "en", "value": "nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the `/api/v1/*` route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at `internal/api/hosts.go:384`: \"API trusts the bearer token for authorisation; per-CA ownership is enforced only in the Web layer.\" The Web UI gates state-changing routes through `loadAccessibleCA` (`internal/web/cas.go`); CA-management endpoints in `internal/api/cas.go` ALSO have proper `canAccessCA` gates. The gap is on the host, network, firewall, mobile-bundle, and most operator endpoints. Combined with the per-operator CA model from ADR 0002, this gives any non-admin operator API key broad cross-tenant access \u2014 instant privilege escalation in the worst case. Version 0.3.4 fixes the issue."}], "source": {"advisory": "GHSA-598g-h2vc-h5vg", "discovery": "UNKNOWN"}}}}

{}

{}

{}

{}