CVE-2026-63464 Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`
Non-admin operators can bypass SSRF protections to force the server to request internal network addresses.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63464?
CVE-2026-63464 is a high-severity server-side request forgery vulnerability in forgekeep nebula-mesh, published on 4 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators (role user) can set allow_private: true on their own managed webhook subscription (POST/PATCH /api/v1/webhook-subscriptions). No admin check exists on this field. At delivery time, allow_private switches the dispatcher to an unguarded HTTP client, bypassing the private/loopback/link-local SSRF guard — letting a low-privilege operator make the server request internal addresses. This issue has been patched in version 0.7.2.
Which versions are affected by CVE-2026-63464?
3 open source packages ship an affected version, including github.com/forgekeep/nebula-mesh.
| Package | Affected | Fixed in |
|---|---|---|
github.com/forgekeep/nebula-mesh Go | From 0.6.0 | 0.7.2 |
github.com/forgekeep/nebula-mesh Go | From 0.6.0 | 0.7.2 |
github.com/forgekeep/nebula-mesh Go | From 0.6.0 | 0.7.2 |
How do I fix CVE-2026-63464?
Upgrade github.com/forgekeep/nebula-mesh to 0.7.2 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-63464 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-63464 exists.
Sources
Also known as GHSA-7rx3-5wx3-5v76, GO-2026-5985.