CVE-2026-55512: Nebula-Mesh OIDC Auth Bypass Vulnerability

CVE-2026-55512 Overview

CVE-2026-55512 affects nebula-mesh, a self-hosted control plane for the Slack Nebula mesh VPN. When OpenID Connect (OIDC) is enabled, the GET /ui/oidc/login endpoint is reachable without authentication and is registered outside the Web UI's rate-limited auth routes. Each request allocates a fresh random OIDC state value and stores it in an in-memory map for 10 minutes. An unauthenticated remote client can flood the endpoint to grow the OIDC.states map for the full state time-to-live (TTL), causing memory exhaustion. The issue is classified as uncontrolled resource consumption [CWE-400] and was patched in version 0.5.0.

Critical Impact
An unauthenticated remote attacker can exhaust server memory by flooding the OIDC login endpoint, degrading availability of the nebula-mesh control plane.

Affected Products

nebula-mesh versions 0.2.0 through 0.4.x (when OIDC is enabled)
forgekeep/nebula-mesh control plane component
Fixed in nebula-mesh 0.5.0

Discovery Timeline

2026-09-04 - CVE-2026-55512 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-55512

Vulnerability Analysis

The flaw resides in the OIDC login handler within internal/web/oidc.go. The /ui/oidc/login route was registered on the router without the auth rate-limit middleware that guards other authentication endpoints. Every request generates a random OIDC state value and inserts it into an in-memory map keyed by that state. Entries are only swept lazily once their 10-minute TTL expires.

Because the allocation path lacks both a rate limiter and a maximum live-state cap, request throughput is the only bound on map growth. An anonymous client issuing sustained requests can accumulate a large volume of pending state entries that persist for the full TTL window, driving memory usage of the nebula-mesh process upward until availability degrades.

Root Cause

The root cause is a missing rate limit combined with an unbounded server-side state cache. The route registration in internal/web/web.go bypassed the shared auth rate-limit bucket, and the state map in oidc.go had no ceiling on concurrently pending logins. Together, these conditions allow uncontrolled resource consumption.

Attack Vector

The attack requires only network reachability to the nebula-mesh Web UI when OIDC is enabled. No authentication, credentials, or user interaction are needed. An attacker sends repeated GET /ui/oidc/login requests to inflate the OIDC.states map for the duration of the 10-minute TTL.

// Patch: internal/web/oidc.go - introduces a hard cap on live OIDC states
const (
	oidcStateCookieName = "nebula_oidc_state"
	oidcStateTTL        = 10 * time.Minute
	// oidcMaxLiveStates caps the number of concurrently pending OIDC login
	// states. Combined with the auth rate limiter on /ui/oidc/login, it bounds
	// the in-memory state map so an unauthenticated flood cannot grow it for
	// the full TTL window (GHSA-m3cx-mwpg-32jg). Real deployments have at most
	// a handful of in-flight logins, so this ceiling leaves ample headroom.
	oidcMaxLiveStates = 4096
)

Source: GitHub Commit bc38708

Detection Methods for CVE-2026-55512

Indicators of Compromise

Elevated request volume to /ui/oidc/login from a single source IP or small set of source IPs.
Sustained growth in resident memory usage of the nebula-mesh process without a corresponding rise in successful logins.
Web server access logs showing many GET /ui/oidc/login entries with no matching /ui/oidc/callback completions.

Detection Strategies

Alert on request-rate anomalies against the OIDC login endpoint compared to a rolling baseline.
Correlate /ui/oidc/login request counts against process memory metrics for nebula-mesh instances.
Flag source IPs that repeatedly initiate OIDC flows without completing the callback exchange.

Monitoring Recommendations

Ingest nebula-mesh HTTP access logs and process-level memory metrics into a centralized analytics platform.
Track the ratio of OIDC login initiations to successful callbacks and alert on sharp divergences.
Monitor 4xx and 5xx responses from the nebula-mesh Web UI that coincide with memory pressure or restarts.

How to Mitigate CVE-2026-55512

Immediate Actions Required

Upgrade nebula-mesh to version 0.5.0 or later, which registers /ui/oidc/login behind the shared auth rate limiter and caps live OIDC states at 4096.
Restrict network exposure of the nebula-mesh Web UI to trusted administrative networks or VPN clients.
If upgrade is not immediately possible and OIDC is not required, disable the OIDC provider configuration to remove the reachable endpoint.

Patch Information

The fix is available in nebula-mesh v0.5.0. The remediation adds the auth rate-limit middleware to /ui/oidc/login and enforces an oidcMaxLiveStates ceiling in the handler as defense in depth. Additional context is available in GHSA-m3cx-mwpg-32jg.

Workarounds

Place a reverse proxy or web application firewall in front of nebula-mesh to enforce per-source request-rate limits on /ui/oidc/login.
Apply network access control lists to restrict which client IP ranges may reach the Web UI.
Set operating system or container memory limits on the nebula-mesh process so exhaustion attempts trigger a controlled restart rather than host-wide impact.

bash

# Example: rate-limit /ui/oidc/login at an nginx reverse proxy
limit_req_zone $binary_remote_addr zone=oidc_login:10m rate=5r/m;

server {
    listen 443 ssl;
    server_name nebula-mesh.example.com;

    location = /ui/oidc/login {
        limit_req zone=oidc_login burst=5 nodelay;
        proxy_pass http://nebula_mesh_backend;
    }

    location / {
        proxy_pass http://nebula_mesh_backend;
    }
}