EUVD-2026-71721Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Requires a valid user-role API key (PR:L); scope change applies as SSRF reaches internal systems outside the nebula-mesh boundary; no integrity or availability impact from the SSRF read mechanism.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
6DescriptionCVE.org
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators (role user) can set allow_private: true on their own managed webhook subscription (POST/PATCH /api/v1/webhook-subscriptions). No admin check exists on this field. At delivery time, allow_private switches the dispatcher to an unguarded HTTP client, bypassing the private/loopback/link-local SSRF guard - letting a low-privilege operator make the server request internal addresses. This issue has been patched in version 0.7.2.
AnalysisAI
Server-side request forgery in nebula-mesh 0.6.0-0.7.1 lets any low-privilege 'user'-role operator coerce the control plane into making HTTP requests to internal, loopback, and link-local addresses by setting allow_private: true on their own webhook subscription. The missing authorization check in both the create and update webhook handlers (internal/api/webhooks.go) means the SSRF guard that protects all other tenants is silently bypassed at delivery time, exposing cloud metadata endpoints, internal APIs, or backend services reachable only from the server. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid nebula-mesh API key with the 'user' (non-admin operator) role - this is the standard credential issued to any onboarded non-admin operator and is not an elevated or specially provisioned credential type. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.7 with S:C/C:H accurately reflects the real-world impact: a legitimate but untrusted low-privilege operator can weaponize the nebula-mesh server as an SSRF proxy into its internal network, reaching cloud metadata services (169.254.169.254/IMDS), internal APIs, or backend systems that are not internet-exposed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade nebula-mesh to version 0.7.2, which adds an explicit isActiveAdmin role check in both handleCreateWebhookSubscription and handleUpdateWebhookSubscription before persisting the allow_private field, returning HTTP 403 to any non-admin caller who supplies the flag. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all nebula-mesh deployments and identify any instances running versions 0.6.0 through 0.7.1, with particular attention to webhook configurations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today