EUVD-2026-49992
GHSA-c6v2-3ffm-vcmc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable web UI (AV:N) with no ownership check (AC:L) needs only a low-priv operator account (PR:L) and no interaction; full cross-tenant read (C:H) plus host delete/cert-revoke (I:H/A:H).
Primary rating from Vendor (https://github.com/juev/nebula-mesh).
CVSS VectorVendor: https://github.com/juev/nebula-mesh
Lifecycle Timeline
3DescriptionCVE.org
Summary
The web UI (/ui/*) does not apply the per-operator CA scoping the JSON API received for GHSA-598g-h2vc-h5vg. Any authenticated non-admin operator (for example, one created via self-registration or OIDC) can access resources belonging to other operators.
Impact
A non-admin operator can:
- Block or delete any other operator's host.
POST /ui/hosts/{id}/blockandDELETE /ui/hosts/{id}act on the URLidwith no ownership check, so a non-admin can block (revoking the host's certificate via the blocklist) or delete any host in the deployment - a cross-operator denial of service. - Read every operator's hosts and networks. The dashboard,
/ui/hosts, the host detail page,/ui/networks(including the create-form error re-render), and the/ui/eventsstream all return data across all operators, exposing host names, Nebula IPs, public IPs, certificate fingerprints and expiry, and network names and CIDRs.
This is the same cross-operator class as GHSA-598g; that remediation covered the JSON API but not the web read/mutation surface. The host create/edit/mobile-bundle/network-create paths and all CA-management routes were already correctly scoped.
Affected handlers (internal/web): handleHostDetail, handleHostBlock, handleHostDelete, handleDashboard, handlePartialStats, handleHosts, handleNetworks, renderNetworksError, handleHostEvents.
Conditions
Exposure requires at least one non-admin operator to exist (self-registration enabled, OIDC, or an admin-created user). A single-admin deployment with no additional operators is not affected.
Fix
A complete candidate fix with regression tests is ready in a private repository shared with the maintainer (ak2k/nebula-mesh-ghsa-web, PR #1): scope these handlers to the session operator's owned CAs (admins keep the full view), mirroring the API's ownership checks.
AnalysisAI
Cross-operator authorization bypass in juev/nebula-mesh (<= 0.3.4) lets any authenticated non-admin operator read and mutate resources owned by other operators through the web UI (/ui/*), which-unlike the JSON API fixed in GHSA-598g-never applies per-operator CA scoping. An attacker with a low-privileged operator account can enumerate every operator's hosts and networks (names, Nebula/public IPs, certificate fingerprints, CIDRs) and can block (revoke certificates) or delete any host in the deployment, causing cross-operator denial of service. No public exploit identified at time of analysis and the issue is not in CISA KEV, but exploitation is trivial for any non-admin user once one exists.
Technical ContextAI
Nebula Mesh is a Go-based management/control-plane application (package github.com/juev/nebula-mesh) that issues and manages certificates and host/network configuration for Slack's Nebula overlay-network mesh. Operators are scoped to the Certificate Authorities (CAs) they own, and the JSON API enforces this ownership after GHSA-598g-h2vc-h5vg. The defect is CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR): the parallel web handlers in internal/web-handleHostDetail, handleHostBlock, handleHostDelete, handleDashboard, handlePartialStats, handleHosts, handleNetworks, renderNetworksError, and handleHostEvents-act on the URL-supplied host id (e.g. POST /ui/hosts/{id}/block, DELETE /ui/hosts/{id}) or return collections without filtering to the session operator's owned CAs. Because the same ownership check that protects the API surface was never mirrored onto the web read/mutation surface, the user-controlled object identifier directly selects records belonging to other tenants.
RemediationAI
No vendor-released patch identified at time of analysis: the advisory states a complete candidate fix with regression tests exists only in a private repository shared with the maintainer (ak2k/nebula-mesh-ghsa-web, PR #1) and no tagged release fixes versions <= 0.3.4, so monitor https://github.com/juev/nebula-mesh/security/advisories/GHSA-c6v2-3ffm-vcmc for an upstream release and upgrade as soon as a patched version ships. Until then, the most effective compensating control is to eliminate the precondition: disable operator self-registration and OIDC sign-up and avoid creating additional non-admin operators, keeping the deployment single-admin (trade-off: prevents multi-tenant/delegated operation, which may be the reason the tool was deployed). Where multiple operators are required, restrict network reachability of the /ui/* web surface to trusted administrators (e.g. via a reverse-proxy allowlist or VPN) and audit existing non-admin accounts, since any one of them can already block or delete other operators' hosts. As a code-level remediation for self-builders, mirror the API's ownership checks by scoping the affected internal/web handlers to the session operator's owned CAs while preserving the full view for admins.
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today