CVE-2026-55513 nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens
Authenticated operators can bypass configured enrollment token TTL limits via the Web UI, minting tokens valid for 24 hours instead of the intended shorter duration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55513?
CVE-2026-55513 is a medium-severity vulnerability in forgekeep nebula-mesh, published on 4 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path ignores both the server-wide enrollment_token_ttl security setting and per-network network_config.enrollment_token_ttl overrides. API host creation and token-regeneration paths use the configured TTL resolver, but POST /ui/hosts hardcodes now.Add(24 * time.Hour) for newly minted agent enrollment tokens. In deployments that intentionally reduce enrollment-token lifetime, any authenticated operator who can create a host through the Web UI can still mint a bearer enrollment token valid for about 24 hours. This issue has been patched in version 0.5.0.
Weakness: CWE-613
Which versions are affected by CVE-2026-55513?
4 open source packages ship an affected version, including github.com/forgekeep/nebula-mesh and github.com/juev/nebula-mesh.
| Package | Affected | Fixed in |
|---|---|---|
github.com/forgekeep/nebula-mesh Go | From 0.3.0 | 0.5.0 |
github.com/forgekeep/nebula-mesh Go | From 0.3.0 | 0.5.0 |
github.com/forgekeep/nebula-mesh Go | From 0.4.0 | 0.5.0 |
github.com/juev/nebula-mesh Go | From 0.3.0 | None |
How do I fix CVE-2026-55513?
Upgrade github.com/forgekeep/nebula-mesh to 0.5.0 or later.
Is CVE-2026-55513 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55513 exists.
Sources
Also known as GHSA-g4x6-jcvr-9m3g, GO-2026-5987.