Vulnerability · Published Jul 28, 2026 · Assigned by GitHub_M
CVE-2026-47725nebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpoints
Medium 6.9
In plain English
A medium-severity cross-site request forgery in nebula-mesh from juev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/* POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits but does not protect: top-level form-submit navigations from third-party pages (some browsers still send Lax cookies on top-level POSTs); same-registrable-domain attackers (sibling-subdomain XSS, subdomain takeover); the GET /ui/logout route, which a third-party <img src=".../ui/logout"> can force-trigger. This issue has been patched in version 0.3.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/juev/nebula-mesh | 0.3.3 | GHSA-273q-qgh5-wrj6 |
| Go | github.com/juev/nebula-mesh | 0.3.3 | GO-2026-5049 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| juev | nebula-mesh | < 0.3.3 |
Weakness: CWE-352 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-273q-qgh5-wrj6 x_refsource_CONFIRM
- https://github.com/forgekeep/nebula-mesh/releases/tag/v0.3.3 x_refsource_MISC