CVE-2026-47725: nebula-mesh Control Plane CSRF Vulnerability

CVE-2026-47725 Overview

CVE-2026-47725 is a Cross-Site Request Forgery (CSRF) vulnerability in nebula-mesh, a self-hosted control plane for the Slack Nebula mesh virtual private network (VPN). Versions prior to 0.3.3 process every /ui/* state-changing route (POST, PUT, PATCH, DELETE) as soon as the session cookie validates, without an anti-CSRF token. The SameSite=Lax attribute on the session cookie blocks many cross-site form submissions but leaves several attack paths open. The issue is tracked as [CWE-352] and was patched in version 0.3.3.

Critical Impact
Authenticated administrators can be tricked into executing unwanted state-changing actions against the nebula-mesh control plane, including forced logout via a third-party <img> tag referencing /ui/logout.

Affected Products

nebula-mesh control plane versions prior to 0.3.3
Deployments exposing the /ui/* routes to authenticated administrator sessions
Instances sharing a registrable domain with attacker-controlled subdomains

Discovery Timeline

2026-07-28 - CVE-2026-47725 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-47725

Vulnerability Analysis

The nebula-mesh control plane authenticates administrative UI requests using only a session cookie. Every /ui/* route that accepts POST, PUT, PATCH, or DELETE executes as soon as that cookie validates. No synchronizer token, double-submit cookie, or origin check gates the request. This design leaves administrative state changes reachable through cross-origin request forgery.

The session cookie carries the SameSite=Lax attribute. Lax reduces the attack surface for typical cross-site form submissions, but it does not fully close the CSRF gap for this application.

Root Cause

The root cause is missing CSRF protection on authenticated, state-changing endpoints [CWE-352]. The application treats a valid session cookie as sufficient authorization for any request that carries it, without verifying that the request originated from the nebula-mesh UI itself.

Three residual gaps make exploitation practical:

Some browsers still transmit SameSite=Lax cookies on top-level POST navigations initiated by a third-party page.
Attackers who control a sibling subdomain, through subdomain takeover or cross-subdomain scripting, share the registrable domain and can bypass the Lax boundary.
The GET /ui/logout route performs a state change on a GET request, so any third-party page can trigger logout by embedding <img src=".../ui/logout">.

Attack Vector

An attacker hosts a malicious page and lures an authenticated nebula-mesh administrator to visit it. The page issues top-level form submissions or embeds resource tags that target /ui/* endpoints on the victim's control plane. The victim's browser attaches the session cookie automatically, and the control plane processes the forged request. Because the attack vector is network-based and requires no privileges on the target, exploitation depends only on inducing an authenticated administrator to load attacker-controlled content. The EPSS score for this vulnerability is 0.154%.

No public proof-of-concept code has been released. Refer to the GitHub Security Advisory GHSA-273q-qgh5-wrj6 for the maintainer's technical write-up.

Detection Methods for CVE-2026-47725

Indicators of Compromise

HTTP requests to /ui/* endpoints carrying a Referer or Origin header pointing to a domain other than the nebula-mesh UI
Unexpected GET /ui/logout requests referred by third-party sites or image loads
State-changing requests (POST, PUT, PATCH, DELETE) to /ui/* with no Origin header on browsers that normally send one
Configuration changes to Nebula certificates, hosts, or firewall rules that do not correlate to interactive administrator sessions

Detection Strategies

Enable verbose access logging on the nebula-mesh reverse proxy and alert on /ui/* writes where Origin or Referer does not match the canonical UI host.
Correlate administrator authentication events with subsequent state-changing UI requests to identify actions taken without a preceding login flow.
Baseline normal administrative activity windows and flag /ui/* mutations outside those windows.

Monitoring Recommendations

Forward reverse-proxy and application logs to a centralized analytics platform to retain full request metadata, including Referer, Origin, and User-Agent.
Monitor DNS and certificate transparency logs for new subdomains under the registrable domain hosting nebula-mesh to detect subdomain takeover risk.
Track version telemetry so that instances running nebula-mesh prior to 0.3.3 are flagged for remediation.

How to Mitigate CVE-2026-47725

Immediate Actions Required

Upgrade nebula-mesh to version 0.3.3 or later, as published in the GitHub Nebula Mesh Release notes.
Restrict the nebula-mesh UI to a trusted management network or VPN so administrator sessions are unreachable from arbitrary internet origins.
Terminate active administrator sessions after upgrade to invalidate any cookies that may have been captured or abused.

Patch Information

The maintainers released version 0.3.3 to address the missing CSRF protections. Details are documented in GitHub Security Advisory GHSA-273q-qgh5-wrj6. Deploy the patched release across all nebula-mesh control plane instances before re-enabling administrator access from broad network segments.

Workarounds

Front the nebula-mesh UI with a reverse proxy that rejects state-changing requests when Origin or Referer does not match the UI host.
Serve the nebula-mesh UI on a dedicated registrable domain to eliminate sibling-subdomain CSRF paths from unrelated applications.
Require administrators to access the UI only through an isolated browser profile that holds no unrelated cookies or open tabs.
Enforce short session lifetimes and re-authentication for sensitive administrative routes to shrink the exploitation window.

bash

# Example nginx rule rejecting cross-origin writes to /ui/*
location /ui/ {
    if ($request_method ~ ^(POST|PUT|PATCH|DELETE)$) {
        set $csrf_block "1";
    }
    if ($http_origin = "https://nebula.example.com") {
        set $csrf_block "0";
    }
    if ($csrf_block = "1") {
        return 403;
    }
    proxy_pass http://nebula_mesh_upstream;
}