What is the CVSS score of CVE-2026-47768?

CVE-2026-47768 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-47768?

Yes, a patch is available for CVE-2026-47768. Update the affected software to the latest version immediately.

nebula-mesh CVE-2026-47768

MEDIUM

Improper Encoding or Escaping of Output (CWE-116)

2026-06-10 https://github.com/juev/nebula-mesh

GHSA-9pg3-25fq-p6cc

Nginx Information Disclosure

5.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

AV:L because exploitation requires log or browser history access on shared infrastructure; PR:L because the operator triggering key creation must be authenticated; C:H because the full bearer token is exposed with no integrity or availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 10, 2026 - 22:51 vuln.today

Analysis Generated

Jun 10, 2026 - 22:51 vuln.today

DescriptionGitHub Advisory

internal/web/operators.go:251 - after handleOperatorCreateAPIKey mints a fresh 32-byte bearer token, the redirect points the operator's browser at:

/ui/operators/<id>?new_key=<raw-token>&key_name=<name>

The raw API key ends up:

in the browser's URL history
in the Referer header on every cross-origin asset the detail page loads (any third-party SVG/CSS/JS resource the layout pulls in)
in any reverse-proxy or load-balancer access log on the path (nginx default combined log captures the query string)
in any structured log sink the operator's local browser-history backup tool ships out

Authorization: Bearer <token> headers go through the same hops without these problems because access logs typically don't capture request headers and the browser doesn't replay headers cross-origin.

Same handler also appends name (r.FormValue("name")) to the query string without url.QueryEscape, so an & in the operator-supplied key name corrupts query parsing and a \r\n in older proxies could split response headers.

Affected

All released versions up to v0.3.1.

Reproducer

As admin, create an API key via /ui/operators/<id>/api-keys (form POST). The 303 Location header carries the raw token in the query string. Open browser DevTools → Network → response headers; or check the reverse-proxy access log; or check the operator-detail page's Referer-emitting fetches.

Suggested fix

Stash the raw key in a one-shot server-side flash storage (e.g., a row in operator_sessions keyed by session token, with a one_shot_token column and consumed_at) or in a short-lived signed cookie. Render the key once inline on the detail page after the redirect, and clear the storage on render. Pattern mirrors the recovery-codes display in the TOTP flow.

If the flash-storage refactor is too invasive, the minimal fix is to render the key inline via a POST → 200 OK with HTML (no redirect), losing the post-redirect-get idiom but eliminating the URL exposure.

Also fix name query encoding with url.QueryEscape regardless of which fix shape lands.

CVSS estimate

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - 5.5 (medium). AV:L because realistic exploit requires log-read access on shared infrastructure (proxy, CDN, browser-history backup) the operator's session touches.

AnalysisAI

Sensitive information disclosure in nebula-mesh (all versions ≤ v0.3.1) leaks newly-minted 32-byte operator API bearer tokens into browser URL history, cross-origin Referer headers, and reverse-proxy access logs by embedding the raw token in a 303 redirect query string. Any actor with read access to nginx combined-format logs, CDN logs, or browser history backup storage can harvest the token and impersonate the operator via the API. A secondary CWE-116 flaw in the same handler omits url.QueryEscape on the user-supplied key name, enabling query-string corruption and potential header injection in older proxies. No public exploit identified at time of analysis; a detailed step-by-step reproducer is included in the GitHub Security Advisory GHSA-9pg3-25fq-p6cc. Fix is available in v0.3.2.

Technical ContextAI

nebula-mesh is a Go-based mesh network management application (pkg:go/github.com/juev/nebula-mesh). The flaw originates in the handleOperatorCreateAPIKey handler at internal/web/operators.go:251, which issues a 303 redirect to /ui/operators/<id>?new_key=<raw-token>&key_name=<name> after minting the token. The root cause is CWE-116 (Improper Encoding or Escaping of Output): sensitive credential material is placed verbatim into a URL, a context that carries the data into browser history, the HTTP Referer header on subsequent cross-origin sub-resource requests, and access logs. Nginx's default combined log format records the full request URI including query string, making every proxy in the request path a potential token archive. Authorization: Bearer headers used for normal API calls do not share this exposure because web servers typically omit request headers from access logs and browsers do not replay them cross-origin. The secondary issue - missing url.QueryEscape on r.FormValue("name") - can corrupt query parsing when the name contains an ampersand, and a CRLF sequence in the name field could split response headers in older or misconfigured proxy implementations.

RemediationAI

Upgrade nebula-mesh to v0.3.2, the vendor-released patch confirmed in the GitHub Security Advisory GHSA-9pg3-25fq-p6cc (https://github.com/juev/nebula-mesh/security/advisories/GHSA-9pg3-25fq-p6cc). The advisory recommends replacing the redirect-with-token pattern with a server-side one-shot flash storage mechanism - storing the token in operator_sessions with a consumed_at field, rendering it once on the detail page, then clearing it - mirroring the TOTP recovery-code display flow. An alternative minimal fix is a POST → 200 OK with HTML response that renders the token inline without a redirect, eliminating query-string exposure at the cost of the post-redirect-get idiom. The url.QueryEscape fix for the name parameter should be applied regardless of which approach is chosen. If immediate upgrade is not feasible, the following compensating controls apply with noted trade-offs: configure nginx to omit query strings from access logs (e.g., replace $request with a custom log variable excluding query parameters - this reduces log forensic value), restrict read access to nginx and CDN access logs to break the log-based attack path, and audit any third-party resources loaded by the operator detail page to eliminate Referer-based exposure. These controls are layered mitigations, not substitutes for patching, and do not address all exposure vectors (e.g., browser history backup tools).