Security
فارسی
All products

github.com/forgekeep/nebula-mesh

Go · Package
8 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`CVE-2026-63464 · GHSA-7RX3-5WX3-5V76Version ranges need review. github.com/forgekeep/nebula-mesh Go High Fix reported
nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokensCVE-2026-55513 · GHSA-G4X6-JCVR-9M3GVersion ranges need review. github.com/forgekeep/nebula-meshgithub.com/juev/nebula-mesh Go Medium Fix reported
nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limitingCVE-2026-55512 · GHSA-M3CX-MWPG-32JGVersion ranges need review. github.com/forgekeep/nebula-meshgithub.com/juev/nebula-mesh Go Medium Fix reported
nebula-mesh: Host revocation is not durable - blocked/offboarded hosts can regain a valid certificateCVE-2026-53602 · GHSA-339V-266X-79XRVersion ranges need review. github.com/forgekeep/nebula-mesh Go Medium Fix reported
nebula-mesh: Certificate revocation is never enforced at the meshCVE-2026-61699 · GHSA-CM26-5974-52H8Version ranges need review. github.com/forgekeep/nebula-mesh Go High Fix reported
nebula-mesh: Operator session tokens stored in plaintext in the databaseCVE-2026-53603 · GHSA-Q4VM-PQ3Q-8WGQVersion ranges need review. github.com/forgekeep/nebula-mesh Go High Fix reported
nebula-mesh: CA private key not zeroized on web mobile-bundle error pathsCVE-2026-53604 · GHSA-2P2F-PX33-4VV5Version ranges need review. github.com/forgekeep/nebula-mesh Go High Fix reported
nebula-mesh: Decrypted CA private key persists in heap after signingCVE-2026-48025 · GHSA-8H84-FHQQ-Q58VVersion ranges need review. github.com/forgekeep/nebula-meshgithub.com/juev/nebula-mesh Go Medium Fix reported