CVE-2025-62820 Slack Nebula may accept arbitrary source IP addresses
Slack Nebula mishandles CIDR configurations, allowing attackers to bypass source IP restrictions and access the network.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-62820?
CVE-2025-62820 is a medium-severity authentication bypass vulnerability in Slack Nebula, published on 23 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.
Weakness: CWE-420
Which versions are affected by CVE-2025-62820?
3 open source packages ship an affected version, including github.com/slackhq/nebula.
| Package | Affected | Fixed in |
|---|---|---|
github.com/slackhq/nebula Go | From 1.9.4 | 1.9.7 |
github.com/slackhq/nebula Go | From 1.9.4 | 1.9.7 |
github.com/slackhq/nebula Go | From 1.9.4 | 1.9.7 |
How do I fix CVE-2025-62820?
Upgrade github.com/slackhq/nebula to 1.9.7 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-62820 being exploited?
There is no known exploitation of CVE-2025-62820 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-KX60703, CLEANSTART-2026-PQ02087, CLEANSTART-2026-ZK17836, GHSA-x6fh-7qmf-69xh, GO-2025-4068, MINI-cw98-4w4w-c78v.