CVE-2026-47726: Nebula-Mesh Information Disclosure Bug

CVE-2026-47726 Overview

CVE-2026-47726 is a broken access control vulnerability in nebula-mesh, a self-hosted control plane for the Slack Nebula mesh virtual private network (VPN). Versions prior to 0.3.2 fail to enforce an administrator role check on the audit log API endpoint. Any operator holding a valid bearer API key can retrieve up to 1000 audit entries by calling the handleGetAuditLog route in internal/api/audit.go. Returned data includes cross-tenant actor names, host and Certificate Authority (CA) identifiers, operator IDs, action timestamps, and masked-IP entries from rate-limit refusals. The issue is classified under [CWE-285] Improper Authorization and was patched in nebula-mesh v0.3.2.

Critical Impact
A low-privileged operator API key can enumerate cross-tenant activity, infer staffing patterns, and identify high-value targets across the entire mesh control plane.

Affected Products

nebula-mesh versions prior to 0.3.2
forgekeep/nebula-mesh control plane deployments
Multi-tenant Slack Nebula mesh VPN deployments managed through nebula-mesh

Discovery Timeline

2026-07-28 - CVE-2026-47726 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-47726

Vulnerability Analysis

The defect resides in internal/api/audit.go:12 inside the handleGetAuditLog function. The route is protected only by bearer token authentication and does not validate whether the authenticated actor holds the admin role. Any operator with a valid API key can invoke the endpoint and receive results from store.ListAuditEntries up to the default limit of 1000 entries.

Because the audit log is global, a single tenant's operator key retrieves records that belong to unrelated tenants on the same control plane. Leaked fields include actor names, host and CA identifiers, operator IDs, action timestamps, and masked-IP entries generated by rate-limit refusals. This exposure supports reconnaissance activities such as mapping tenant boundaries, timing operator shifts, and singling out high-value CAs or hosts.

Root Cause

The root cause is a missing authorization check ([CWE-285]) on a privileged administrative route. Authentication was conflated with authorization: possessing any valid bearer token was treated as sufficient to view privileged audit data.

Attack Vector

An attacker who has obtained or been issued any operator API key issues an authenticated HTTP GET request to the audit log endpoint. No user interaction and no elevated privileges are required beyond a baseline operator token.

 const defaultAuditLimit = 100
 
 func (s *Server) handleGetAuditLog(w http.ResponseWriter, r *http.Request) {
+	if !actorIsAdmin(r.Context()) {
+		writeError(w, http.StatusForbidden, "audit log access requires the admin role")
+		return
+	}
 	filter := store.AuditFilter{
 		Action: r.URL.Query().Get("action"),
 		Limit:  defaultAuditLimit,

Source: nebula-mesh commit 8baaace5. The patch inserts an actorIsAdmin(r.Context()) gate that returns HTTP 403 when the caller is not an administrator.

Detection Methods for CVE-2026-47726

Indicators of Compromise

HTTP GET requests to the audit log route from non-admin operator API keys prior to upgrading to v0.3.2.
Repeated audit log queries containing the action or limit query parameters originating from a single operator token.
Bursts of successful 200-status responses from the audit endpoint tied to tenants that do not own the queried records.

Detection Strategies

Enable request logging on the nebula-mesh HTTP API and alert on any 200 responses from the audit route where the caller lacks the admin role.
Correlate operator API key identifiers against tenant ownership to flag cross-tenant audit reads.
Baseline typical audit log query volume per operator and alert on statistical outliers.

Monitoring Recommendations

Forward nebula-mesh application logs to a centralized SIEM or data lake and retain them for at least 90 days.
Track invocations of store.ListAuditEntries and record actor identity, tenant ID, and result count.
Review rate-limit refusal telemetry, since masked-IP entries in the audit log are among the fields disclosed by this vulnerability.

How to Mitigate CVE-2026-47726

Immediate Actions Required

Upgrade nebula-mesh to version 0.3.2 or later, which introduces the actorIsAdmin check on the audit log endpoint.
Rotate all operator API keys that existed before the upgrade to invalidate any tokens that may have been used to enumerate audit data.
Audit historical logs for cross-tenant reads of the audit route and notify affected tenants where evidence of enumeration exists.

Patch Information

The fix is included in nebula-mesh v0.3.2 and documented in GitHub Security Advisory GHSA-qm33-p5p9-f8vg. The commit adds an explicit admin role check in handleGetAuditLog and introduces the actorOwnsCA authorization helper in internal/api/authz.go.

Workarounds

If immediate upgrade is not possible, block the audit log route at a reverse proxy or Web Application Firewall (WAF) for all callers except administrator source IP ranges.
Revoke non-admin operator API keys until the control plane is patched.
Restrict issuance of operator API keys and enforce short token lifetimes to reduce the exposure window.

bash

# Example nginx reverse-proxy rule restricting the audit endpoint until patched
location = /api/audit {
    allow 10.0.0.0/24;   # admin management subnet
    deny  all;
    proxy_pass http://nebula-mesh-upstream;
}