CVE-2026-49258: Nebula Mesh Auth Bypass Vulnerability

CVE-2026-49258 Overview

CVE-2026-49258 is an authorization bypass vulnerability in Nebula Mesh, a self-hosted control plane for the Slack Nebula mesh VPN. The web UI (/ui/*) fails to apply per-operator Certificate Authority (CA) scoping that the JSON API enforces. Any authenticated non-admin operator, including those created through self-registration or OpenID Connect (OIDC), can access resources owned by other operators. A prior fix tracked as GHSA-598g-h2vc-h5vg addressed the JSON API but omitted the web read and mutation surface. The issue affects versions 0.3.5 and below and is corrected in version 0.3.6.

Critical Impact
A malicious authenticated operator can read any other operator's hosts and networks, or block and delete hosts belonging to other operators.

Affected Products

Nebula Mesh versions 0.3.5 and below
forgekeep/nebula-mesh control plane web UI (/ui/*)
Deployments using self-registration or OIDC for operator provisioning

Discovery Timeline

2026-07-28 - CVE-2026-49258 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-49258

Vulnerability Analysis

The vulnerability is an Authorization Bypass Through User-Controlled Key [CWE-639] affecting the Nebula Mesh web interface. The JSON API layer enforces per-operator CA scoping so that each operator can only view or modify resources tied to their own CA. The web UI routes under /ui/* reuse authentication but skip the equivalent scoping checks on host and network read and mutation endpoints. An authenticated operator can therefore issue requests through the web surface that reference resource identifiers belonging to other operators. The server processes those requests without verifying CA ownership. Host create, edit, mobile-bundle, and network-create paths, along with all CA-management routes, were already correctly scoped and are not affected.

Root Cause

The root cause is inconsistent enforcement of access control between the JSON API and the web UI. The partial remediation applied in GHSA-598g-h2vc-h5vg scoped API handlers to the caller's CA but did not extend those checks into the web read and mutation handlers. Authorization logic was applied at one layer rather than centrally, leaving parallel routes unprotected.

Attack Vector

An attacker needs valid non-admin operator credentials on the target Nebula Mesh instance. Where self-registration or OIDC federation is enabled, obtaining such credentials requires only account creation. The attacker then authenticates to the web UI and requests host or network resources identified by another operator's object references. Because scoping is absent, the server returns or mutates the requested objects. Impact includes disclosure of host and network configuration, denial of service through blocking or deletion of hosts, and integrity loss across tenant boundaries.

No verified exploit code is publicly available. See the GitHub Security Advisory GHSA-c6v2-3ffm-vcmc and the remediation pull request for technical details.

Detection Methods for CVE-2026-49258

Indicators of Compromise

Web UI access logs showing requests to /ui/* host or network endpoints where the referenced resource identifiers do not belong to the requesting operator's CA.
Unexpected block or delete operations against hosts, correlated with sessions from non-admin operator accounts.
Newly self-registered or OIDC-provisioned operator accounts that enumerate host and network resources shortly after creation.

Detection Strategies

Compare operator session identity against the CA of each accessed host or network resource in application logs, and alert on cross-CA access.
Baseline typical read volumes per operator and flag accounts that enumerate resources beyond their assigned scope.
Review audit trails for host deletions and blocks that do not correspond to the CA-owning operator.

Monitoring Recommendations

Enable verbose audit logging on all /ui/* routes and forward events to a centralized logging platform for correlation.
Monitor operator account provisioning events, particularly self-registration and OIDC first-login flows, for follow-on resource access patterns.
Alert on any host lifecycle mutation (block, delete) performed by non-admin operators.

How to Mitigate CVE-2026-49258

Immediate Actions Required

Upgrade Nebula Mesh to version 0.3.6 or later, which applies per-operator CA scoping to the web UI routes.
Audit host and network resources for unauthorized modifications, deletions, or blocks performed since version 0.3.5 was deployed.
Review the operator inventory and disable any unrecognized accounts created through self-registration or OIDC.

Patch Information

The fix is available in Nebula Mesh version 0.3.6. The remediation is tracked in pull request #161 and documented in GHSA-c6v2-3ffm-vcmc. The change extends the CA scoping logic previously applied to the JSON API to the web read and mutation handlers.

Workarounds

Disable operator self-registration until the upgrade to 0.3.6 is complete.
Restrict OIDC-based operator provisioning to trusted identity providers and known users.
Limit web UI network reachability to administrative networks using firewall rules or a reverse proxy access control list.

bash

# Verify installed Nebula Mesh version and upgrade
nebula-mesh --version
# Upgrade to the fixed release
docker pull ghcr.io/forgekeep/nebula-mesh:0.3.6
docker stop nebula-mesh && docker rm nebula-mesh
docker run -d --name nebula-mesh ghcr.io/forgekeep/nebula-mesh:0.3.6