CVE-2026-55513: nebula-mesh Auth Bypass Vulnerability

CVE-2026-55513 Overview

CVE-2026-55513 affects nebula-mesh, a self-hosted control plane for Slack's Nebula mesh VPN. The vulnerability exists in the nebula-mgmt Web UI host-creation path, which ignores both the server-wide enrollment_token_ttl setting and per-network network_config.enrollment_token_ttl overrides. The POST /ui/hosts handler hardcodes now.Add(24 * time.Hour) when minting agent enrollment tokens, instead of resolving the configured TTL like the API and token-regeneration paths do. Any authenticated operator who can create a host through the Web UI can mint a bearer enrollment token valid for approximately 24 hours, even in deployments that deliberately reduce token lifetime. The issue is classified as [CWE-613] Insufficient Session Expiration.

Critical Impact
Authenticated Web UI operators can mint enrollment tokens with a 24-hour lifetime, bypassing hardened TTL policies and extending the window for token theft or misuse.

Affected Products

nebula-mesh versions 0.3.0 through 0.4.x
nebula-mgmt Web UI host-creation endpoint (POST /ui/hosts)
Deployments enforcing custom enrollment_token_ttl values

Discovery Timeline

2026-09-04 - CVE-2026-55513 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-55513

Vulnerability Analysis

The nebula-mesh control plane exposes multiple paths for creating hosts and issuing agent enrollment tokens. The REST API and the token-regeneration path resolve token lifetime through the configured TTL resolver, honoring both the global enrollment_token_ttl and per-network overrides. The Web UI host-creation handler (POST /ui/hosts) does not use this resolver. Instead, it hardcodes a 24-hour expiration via now.Add(24 * time.Hour) when minting the enrollment token embedded in the new host record.

Operators who intentionally shorten enrollment token lifetime — for example, to five minutes to enforce a tight enrollment window — see that policy silently bypassed whenever a host is created through the Web UI. Bearer enrollment tokens remain valid for roughly 24 hours regardless of configuration.

Root Cause

The root cause is a missing dependency injection. The Web UI handler was not wired to receive the enrollment TTL resolver during server construction. The patch in commit 514006029e09f1991122b86a80e7b25970bcfa98 adds webUI.WithEnrollmentTokenTTL(cfg.EnrollmentTokenTTLDuration()) in internal/cli/serve.go and imports the shared internal/enrollment package in internal/api/server.go, allowing the UI path to honor the same configuration source as the API.

Attack Vector

Exploitation requires an authenticated operator account with permission to create hosts through the Web UI. The attacker (or a compromised low-privilege operator) creates a host, receives an enrollment token valid for approximately 24 hours, and can use that bearer token to enroll an agent well after the intended TTL should have expired. The extended validity window increases the risk of token exfiltration, replay, and unauthorized agent enrollment into the mesh VPN.

// Patch: internal/cli/serve.go
webUI.WithPasswordPolicy(pwPolicy)
webUI.WithMaster(master)
webUI.WithCAResolver(caResolver)
webUI.WithEnrollmentTokenTTL(cfg.EnrollmentTokenTTLDuration())

// Patch: internal/api/server.go (added import)
"github.com/forgekeep/nebula-mesh/internal/enrollment"

Source: GitHub commit 514006

Detection Methods for CVE-2026-55513

Indicators of Compromise

Enrollment tokens issued via POST /ui/hosts with expiration timestamps approximately 24 hours after issuance, despite a shorter configured TTL.
Agent enrollment requests presenting bearer tokens older than the configured enrollment_token_ttl.
Unexpected host records created through the Web UI by operators who normally use the API.

Detection Strategies

Audit nebula-mesh host records and compare issued enrollment token exp claims against the configured enrollment_token_ttl in network_config.
Correlate Web UI authentication events with subsequent POST /ui/hosts calls and downstream agent enrollments occurring hours later.
Review operator activity logs for host-creation bursts by accounts that do not typically provision agents.

Monitoring Recommendations

Enable request logging on the nebula-mgmt Web UI and forward logs to a central SIEM for TTL anomaly detection.
Alert when enrollment token lifetimes on newly created hosts exceed the policy defined in network_config.enrollment_token_ttl.
Track first-use timestamps of enrollment tokens to identify tokens consumed outside the intended enrollment window.

How to Mitigate CVE-2026-55513

Immediate Actions Required

Upgrade nebula-mesh to version 0.5.0 or later, which wires the configured TTL resolver into the Web UI host-creation path.
Revoke any outstanding enrollment tokens minted through the Web UI prior to the upgrade, then re-issue them under the corrected TTL.
Restrict Web UI host-creation permissions to a minimal set of trusted operators until the patch is deployed.

Patch Information

The fix is available in nebula-mesh v0.5.0. The corrective change is documented in GitHub commit 514006 and detailed in GitHub Security Advisory GHSA-g4x6-jcvr-9m3g. Upgrading to 0.5.0 ensures both API and Web UI paths use cfg.EnrollmentTokenTTLDuration() when minting enrollment tokens.

Workarounds

Disable the Web UI host-creation flow and require host provisioning through the API, which correctly honors the configured TTL.
Restrict access to the nebula-mgmt Web UI at the network layer to trusted administrative hosts.
Rotate operator credentials with Web UI access and enforce least-privilege role assignments.

bash

# Upgrade nebula-mesh to the patched release
git fetch --tags
git checkout v0.5.0
# Restart the control plane so WithEnrollmentTokenTTL takes effect
systemctl restart nebula-mgmt