Vulnerability · Published Sep 4, 2026 · Assigned by GitHub_M
CVE-2026-63464Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`
High 7.7
In plain English
A high-severity missing authorization in nebula-mesh from forgekeep. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators (role user) can set allow_private: true on their own managed webhook subscription (POST/PATCH /api/v1/webhook-subscriptions). No admin check exists on this field. At delivery time, allow_private switches the dispatcher to an unguarded HTTP client, bypassing the private/loopback/link-local SSRF guard — letting a low-privilege operator make the server request internal addresses. This issue has been patched in version 0.7.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/forgekeep/nebula-mesh | 0.7.2 | GHSA-7rx3-5wx3-5v76 |
| Go | github.com/forgekeep/nebula-mesh | 0.7.2 | GO-2026-5985 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| forgekeep | nebula-mesh | >= 0.6.0, < 0.7.2 |
Weakness: CWE-862, CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N