CVE-2026-47768 nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)
Attackers can steal operator API keys exposed in redirect URLs via browser history or logs, compromising the Nebula mesh control plane.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47768?
CVE-2026-47768 is a medium-severity vulnerability in juev nebula-mesh, published on 28 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs). This issue has been patched in version 0.3.2.
Weakness: CWE-598
Which versions are affected by CVE-2026-47768?
3 open source packages ship an affected version, including github.com/juev/nebula-mesh.
| Package | Affected | Fixed in |
|---|---|---|
github.com/juev/nebula-mesh Go | All versions | 0.3.2 |
github.com/juev/nebula-mesh Go | All versions | 0.3.2 |
github.com/juev/nebula-mesh Go | All versions | 0.3.2 |
How do I fix CVE-2026-47768?
Upgrade github.com/juev/nebula-mesh to 0.3.2 or later.
Is CVE-2026-47768 being exploited?
There is no known exploitation of CVE-2026-47768 in the wild and no public exploit code.
Sources
Also known as GHSA-9pg3-25fq-p6cc, GO-2026-5294.