CVE-2026-47726 in nebula-mesh
Summary
by MITRE • 07/28/2026
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via store.ListAuditEntries (up to limit=1000). This includes cross-tenant actor names, host/CA/operator IDs, action timestamps, and masked-IP entries from rate-limit refusals — enough surface for a tenant to enumerate the server's activity, infer staffing patterns, or identify high-value targets. This issue has been patched in version 0.3.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
The vulnerability identified in nebula-mesh affects the authentication and authorization mechanisms within the control plane's API endpoints. Prior to version 0.3.2, the internal/api/audit.go file contained a critical flaw in the handleGetAuditLog function at line 12 where proper administrative privileges were not enforced. This represents a significant security weakness that violates fundamental principles of access control and privilege separation.
The technical implementation flaw stems from the fact that the API endpoint only implements bearer-authentication gating without requiring administrator-level verification. Any valid operator API key can access the complete audit log through the store.ListAuditEntries function, which retrieves up to 1000 entries regardless of user permissions. This design flaw creates an unauthorized information disclosure vulnerability where tenant users can bypass normal access controls to obtain sensitive operational data.
The operational impact of this vulnerability extends beyond simple information exposure. The audit log contains comprehensive cross-tenant information including actor names, host identifiers, certificate authority details, operator IDs, action timestamps, and masked IP addresses from rate-limiting events. This data provides attackers with sufficient surface area to perform reconnaissance activities such as enumerating server activity patterns, inferring staffing schedules, identifying high-value targets within the network, and mapping the operational landscape of the entire mesh infrastructure.
This vulnerability aligns with CWE-284 (Improper Access Control) and represents a clear violation of the principle of least privilege. The flaw enables unauthorized users to access audit information that should be restricted to administrative personnel only, creating potential for insider threat exploitation and external reconnaissance activities. From an attack perspective, this issue maps to ATT&CK technique T1083 (File and Directory Discovery) and T1562.001 (Impair Defenses: Disable or Modify Tools), as it allows unauthorized access to security-relevant information that could be used to plan further attacks.
The remediation implemented in version 0.3.2 addresses this issue by enforcing proper administrative checks before allowing access to audit log information. This patch ensures that only users with appropriate administrative privileges can retrieve comprehensive audit data, thereby restoring the intended security boundaries and protecting sensitive operational information from unauthorized access. The fix demonstrates the importance of implementing proper authorization controls even for seemingly benign API endpoints that provide access to historical operational data.