CVE-2026-49258 in nebula-mesh
Summary
by MITRE • 07/28/2026
Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI (/ui/*) does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5vg, but the changes were not implemented in the web read/mutation surface. Any authenticated non-admin operator (for example, one created via self-registration or OIDC) can access resources belonging to other operators. The host create/edit/mobile-bundle/network-create paths and all CA-management routes were already correctly scoped. A malicious operator could block or delete any other operator's host, or read any operator's hosts and networks. This issue has been fixed in version 0.3.6.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
The Nebula Mesh vulnerability represents a critical authorization flaw in the Slack Nebula mesh VPN control plane affecting versions 0.3.5 and earlier. This security weakness stems from inconsistent implementation of per-operator certificate authority scoping between the JSON API and web user interface components. While the JSON API correctly enforced operator-specific resource boundaries through CA scoping, the web UI (/ui/* endpoints) maintained a flawed access model that allowed authenticated non-admin operators to traverse into other operators' resource domains. The vulnerability specifically affects authentication mechanisms including self-registered users and those authenticated via OIDC (OpenID Connect) protocols, creating a privilege escalation vector that bypasses intended access controls.
The technical implementation flaw manifests in the web UI's failure to apply the same CA scoping rules that were properly implemented in the JSON API surface. This inconsistency creates a dangerous operational gap where malicious actors with legitimate operator accounts can access, modify, or delete resources belonging to other operators within the same Nebula Mesh deployment. The scope of affected paths includes host management operations such as create/edit/mobile-bundle/network-create routes, along with all certificate authority management functions that were previously correctly scoped. This represents a classic case of incomplete security implementation where partial fixes addressed some components but left others vulnerable to cross-operator resource access.
The operational impact of this vulnerability extends beyond simple information disclosure to encompass full administrative capabilities over other operators' resources. A malicious operator could potentially block network connectivity for other users by deleting their hosts, read sensitive configuration data from other operators' networks, or even create destructive modifications that affect the entire mesh infrastructure. The vulnerability affects all aspects of operator resource management within the web interface, making it a comprehensive authorization bypass that undermines the fundamental security model of multi-tenant operator isolation. This type of flaw aligns with CWE-284 (Improper Access Control) and represents a failure in implementing proper privilege boundaries.
The mitigation strategy involves upgrading to version 0.3.6 or later, which properly implements CA scoping across all UI surfaces including the previously vulnerable web endpoints. Organizations should also implement additional monitoring for unauthorized access patterns and consider network segmentation measures to limit potential damage from compromised operator accounts. This vulnerability demonstrates the importance of comprehensive security testing across all application surfaces, as API endpoint protections alone are insufficient when UI components maintain inconsistent access control policies. The fix addresses the root cause by ensuring complete parity between JSON API and web UI authorization mechanisms, aligning with ATT&CK technique T1078 (Valid Accounts) and T1566 (Phishing) through proper enforcement of least privilege principles.