CVE-2026-48058: Nebula Mesh Information Disclosure Flaw

CVE-2026-48058 Overview

CVE-2026-48058 affects nebula-mesh, a self-hosted control plane for the Slack Nebula mesh virtual private network (VPN). Versions prior to 0.3.2 issue session cookies without the Secure attribute. The files internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but omit Secure. A single plaintext HTTP request to the origin can disclose the session identifier to a network observer. Common triggers include operators on a LAN, mistyped URLs, weak HTTP-to-HTTPS redirects, or reverse proxy misconfiguration. The maintainers patched the flaw in version 0.3.2. The issue is tracked under [CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute].

Critical Impact
Session cookies transmitted over plaintext HTTP can be captured by a network attacker, enabling operator account takeover of the Nebula mesh control plane.

Affected Products

nebula-mesh control plane versions prior to 0.3.2
Deployments exposing the operator web UI on LAN or behind non-strict TLS-terminating proxies
Environments using the OIDC operator login flow in nebula-mesh

Discovery Timeline

2026-07-28 - CVE-2026-48058 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-48058

Vulnerability Analysis

nebula-mesh serves an operator web console that authenticates users through session cookies and an optional OpenID Connect (OIDC) flow. The cookie-issuing code in internal/web/session.go and internal/web/oidc.go applies HttpOnly (blocking JavaScript access) and SameSite=Lax (limiting cross-site delivery), but does not apply the Secure attribute. Without Secure, browsers attach the cookie to any request matching the domain, including plaintext HTTP requests. An attacker positioned on the same LAN segment, on an upstream network path, or intercepting a misdirected HTTP request can passively harvest the session identifier. Once captured, the token grants full operator access to the Nebula mesh control plane until it expires.

Root Cause

The root cause is missing hardening of cookie flags in the session and OIDC handlers. The original code paths built cookies with only HttpOnly and SameSite=Lax, leaving the Secure flag unset regardless of whether the deployment terminated TLS. The fix introduces a resolved cookie_secure setting applied after OIDC wiring, ensuring the state cookie and session cookie both carry Secure on TLS-terminating deployments.

Attack Vector

Exploitation requires network adjacency and a single plaintext request from the victim browser to the nebula-mesh origin. Realistic triggers include an operator typing http:// instead of https://, a reverse proxy that fails to enforce HSTS or a 301 redirect, a captive portal injecting HTTP content, or a compromised LAN peer running ARP spoofing. No user interaction with malicious content is required beyond issuing one HTTP request while authenticated.

// Patch excerpt: internal/cli/serve.go
// Source: https://github.com/forgekeep/nebula-mesh/commit/ffdd67dbf221d9a5855c39fbe11b49c245048d85
		webUI.WithOIDC(oidcProvider)
		logger.Info("oidc enabled", "issuer", cfg.OIDC.Issuer)
		// Surface the relaxed-posture deployment in startup logs so the
		// operator-of-operator sees that email_verified is being skipped.
		if !cfg.OIDC.EmailVerifiedRequired() {
			logger.Warn("oidc email_verified check disabled",
				"oidc_issuer", cfg.OIDC.Issuer,
				"hint", "set oidc.require_email_verified: true (default) to re-enable")
		}
	}

	// Resolve cookie_secure AFTER any OIDC wiring so the OIDC state cookie

Detection Methods for CVE-2026-48058

Indicators of Compromise

Operator session cookies (for example session=) observed traversing plaintext HTTP requests to the nebula-mesh origin in network captures or proxy logs.
Successful operator API actions originating from IP addresses that differ from the address that initiated the login flow.
OIDC state cookies present in HTTP (non-TLS) traffic to the nebula-mesh host during authentication callbacks.

Detection Strategies

Inspect responses from nebula-mesh for Set-Cookie headers lacking the Secure attribute and correlate with version strings less than 0.3.2.
Alert on any HTTP (port 80 or non-TLS) requests directed at hosts running the nebula-mesh operator UI.
Review reverse proxy access logs for HTTP requests that were not redirected to HTTPS before reaching the upstream nebula-mesh service.

Monitoring Recommendations

Enable strict HSTS logging at the reverse proxy and monitor for policy violations or missing headers.
Track OIDC authentication callbacks for anomalous source IP changes between the authorization request and the token exchange.
Log and review nebula-mesh startup messages for the cookie_secure resolution introduced in 0.3.2 to confirm secure posture.

How to Mitigate CVE-2026-48058

Immediate Actions Required

Upgrade nebula-mesh to version 0.3.2 or later, which sets the Secure flag on session and OIDC state cookies.
Terminate TLS in front of nebula-mesh and enforce HTTPS for all operator traffic before restoring access.
Invalidate all active operator sessions after upgrading and require re-authentication.

Patch Information

The fix is available in nebula-mesh v0.3.2. See the GitHub Security Advisory GHSA-rqfj-vv8r-xhqc and the remediation commit for implementation details. The patch resolves cookie_secure after OIDC wiring so both the session cookie and OIDC state cookie carry the Secure attribute.

Workarounds

Block port 80 at the host or reverse proxy so no plaintext request can reach nebula-mesh.
Configure the reverse proxy to issue an unconditional 301 redirect from HTTP to HTTPS and enforce HSTS with includeSubDomains.
Restrict the operator UI to a management VLAN or VPN where plaintext exposure risk is minimized until the upgrade is complete.

bash

# Example nginx snippet enforcing HTTPS in front of nebula-mesh
server {
    listen 80;
    server_name nebula-mesh.example.internal;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name nebula-mesh.example.internal;
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
    ssl_certificate     /etc/ssl/certs/nebula-mesh.crt;
    ssl_certificate_key /etc/ssl/private/nebula-mesh.key;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto https;
    }
}