nebula-mesh CVE-2026-47725

Exploitation requires (1) a target operator with an active authenticated session to the nebula-mesh admin UI in their browser, (2) that operator visiting attacker-controlled HTML in any tab - a click is needed for the <form> POST variants but the <img>-based /ui/logout attack requires no interaction at all, and (3) network reachability from the operator's browser to the nebula-mesh /ui/* endpoint (so internet-exposed or intranet-reachable management UIs are in scope, fully air-gapped ones are not). The reproducer relies on application/x-www-form-urlencoded bodies because r.PostFormValue does not parse multipart or JSON; the current UI surface has no JSON/multipart mutating endpoints, so this is not a limit in practice. Limiting factors: the attacker must know or guess the target's nebula-mesh URL and (for CA-specific actions) the relevant CA ID, and SameSite=Lax does block subresource and iframe-based POSTs in compliant browsers - but it explicitly does not block top-level navigations, sibling-subdomain attackers, or GET-based actions like the vulnerable /ui/logout route.

No CVSS vector or EPSS score is provided, and the issue is not in CISA KEV, so traditional prioritization signals are absent. Mapping to a notional CVSS, this looks like AV:N / AC:L / PR:N / UI:R / S:C / C:H/I:H/A:H - network-reachable, low complexity, requires an authenticated operator to load attacker content, but the post-conditions (CA deletion, key minting, operator disablement) are catastrophic for a PKI/mesh management plane. The CWE-269 mapping understates the issue; the root cause is CWE-352 (CSRF) and the consequence is privilege escalation. Real-world risk is high for any deployment where operators browse the web on the same workstation they use for admin sessions, and elevated further if the management UI shares a registrable domain with other web properties (the patch explicitly notes sibling-subdomain attackers can still forge requests via parent-domain cookies). One caveat: the user-interaction requirement and the limited install base of nebula-mesh likely keep mass exploitation probability low, so this is a targeted-threat issue rather than a wormable one.

An attacker hosts a page containing a hidden <form action="https://nebula.example.com/ui/cas/{ca-id}/delete" method="POST"> (or an <img src="https://nebula.example.com/ui/logout"> for force-logout) and lures a logged-in nebula-mesh operator to visit it via phishing, a watering-hole on an operator-frequented site, or XSS on a sibling subdomain. Because the session cookie is auto-attached on the top-level POST and no CSRF token is required, the server deletes the CA, mints an attacker-chosen API key, or disables a peer operator - all without further interaction. A working reproducer is published in the GHSA advisory itself, so weaponization cost is effectively zero.