CVE-2026-47724 nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation
Attackers with operator API keys can bypass ownership checks to access other tenants' resources, leading to privilege escalation and data modification.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47724?
CVE-2026-47724 is a critical missing authorization vulnerability in juev nebula-mesh, published on 23 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the `/api/v1/*` route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at `internal/api/hosts.go:384`: "API trusts the bearer token for authorisation; per-CA ownership is enforced only in the Web layer." The Web UI gates state-changing routes through `loadAccessibleCA` (`internal/web/cas.go`); CA-management endpoints in `internal/api/cas.go` ALSO have proper `canAccessCA` gates. The gap is on the host, network, firewall, mobile-bundle, and most operator endpoints. Combined with the per-operator CA model from ADR 0002, this gives any non-admin operator API key broad cross-tenant access — instant privilege escalation in the worst case. Version 0.3.4 fixes the issue.
Weakness: CWE-862
Which versions are affected by CVE-2026-47724?
3 open source packages ship an affected version, including github.com/juev/nebula-mesh.
| Package | Affected | Fixed in |
|---|---|---|
github.com/juev/nebula-mesh Go | All versions | 0.3.4 |
github.com/juev/nebula-mesh Go | All versions | 0.3.4 |
github.com/juev/nebula-mesh Go | All versions | 0.3.4 |
How do I fix CVE-2026-47724?
Upgrade github.com/juev/nebula-mesh to 0.3.4 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-47724 being exploited?
There is no known exploitation of CVE-2026-47724 in the wild and no public exploit code.
Sources
Also known as GHSA-598g-h2vc-h5vg, GO-2026-5139.