CVE-2026-47768 in nebula-mesh

Résumé

par MITRE • 28/07/2026

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs). This issue has been patched in version 0.3.2.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• Responsable: GitHub M
• Réserver: 20/05/2026
• Divulgation: 28/07/2026
• Modérer: accepté
• Entrée: VDB-383950
• CPE: prêt
• CWE: CWE-601 (confirmé)
• CVSS: 4.3 (VulDB)
• EPSS: 0.00000
• KEV: non
• Activités: très faible

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-47768
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-47768
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-47768/