CVE Browser

Page 1

Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`

nebula-mesh: Certificate revocation is never enforced at the mesh

nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens

nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting

nebula-mesh: CA private key not zeroized on web mobile-bundle error paths

nebula-mesh: Operator session tokens stored in plaintext in the database

nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate

CVE ID	Description	Severity	CVSS	EPSS	Ecosystems	Published
CVE-2026-63464	Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`	HIGH	7.7	0.46%	Go	Sep 4, 2026
CVE-2026-61699	nebula-mesh: Certificate revocation is never enforced at the mesh	HIGH	8.1	0.45%	Go	Sep 4, 2026
CVE-2026-55513	nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens	MEDIUM	5.4	0.32%	Go	Sep 4, 2026
CVE-2026-55512	nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting	MEDIUM	5.3	0.60%	Go	Sep 4, 2026
CVE-2026-53604	nebula-mesh: CA private key not zeroized on web mobile-bundle error paths	HIGH	8.7	0.18%	Go	Sep 4, 2026
CVE-2026-53603	nebula-mesh: Operator session tokens stored in plaintext in the database	HIGH	7.1	0.35%	Go	Sep 4, 2026
CVE-2026-53602	nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate	MEDIUM	6.9	0.31%	Go	Sep 4, 2026

Rows per page

Showing 1 to 7 CVEs · page 1