nebula-mesh CVE-2026-47768

The vulnerability is triggered whenever an authenticated operator (PR:L - requires operator-level session) creates a new API key via the web UI form POST to /ui/operators/<id>/api-keys. The 303 redirect encoding the raw token in the query string fires unconditionally on this action in all versions ≤ v0.3.1 - no special configuration is required to be vulnerable. For token theft via the log vector, the attacker must have read access to nginx access logs, CDN logs, or any log aggregation system that ingests nginx combined-format output from the nebula-mesh host. For token theft via the Referer vector, the operator detail page must load at least one cross-origin sub-resource (third-party CSS, JS, or SVG), which depends on the deployment's UI assets. For browser history vector, the attacker must have access to the operator's local browser profile or a history backup tool. Limiting factors: an external unauthenticated attacker cannot observe the redirect URL directly; the operator must actively create a key during the attacker's observation window; and log access or browser history access must be obtained independently.

The reporter-assigned CVSS 5.5 Medium score (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the threat model: the confidentiality impact is High (full bearer token compromised), but exploitation is gated behind local access to log infrastructure or browser history storage, pushing the attack vector to Local. No EPSS score is available in the provided intelligence, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis. Real-world risk is environment-dependent and higher than the raw score implies in shared or enterprise deployments: centralized log aggregation systems (e.g., Splunk, Elastic, Loki) routinely ingest nginx access logs, meaning any user with read access to those systems - a potentially large group - becomes a viable attacker. The Referer-based exposure vector is independent of log access and is triggered automatically when the operator detail page loads any cross-origin asset. The CVSS Local vector is appropriate because an unauthenticated external attacker cannot directly read the token from the URL; they must first obtain access to a log store or browser history artifact. No conflicting signals between CVSS and the description were identified.

An infrastructure engineer with read access to the centralized nginx log aggregator queries for URIs matching /ui/operators/ containing new_key= and extracts the raw bearer token from the query string of any operator who recently created an API key. The engineer then crafts HTTP requests to the nebula-mesh API using Authorization: Bearer <stolen-token>, gaining full API access as the targeted operator without triggering any authentication event. Alternatively, if the operator detail page loads a third-party analytics or font CDN resource, the token is silently transmitted in the Referer header to that external origin as a side effect of normal page rendering.