Nebula Mesh
Monthly
Server-side request forgery in nebula-mesh 0.6.0-0.7.1 lets any low-privilege 'user'-role operator coerce the control plane into making HTTP requests to internal, loopback, and link-local addresses by setting allow_private: true on their own webhook subscription. The missing authorization check in both the create and update webhook handlers (internal/api/webhooks.go) means the SSRF guard that protects all other tenants is silently bypassed at delivery time, exposing cloud metadata endpoints, internal APIs, or backend services reachable only from the server. A working proof-of-concept has been verified against a live instance; vendor-released patch v0.7.2 is available.
Server-side request forgery in nebula-mesh 0.6.0-0.7.1 lets any low-privilege 'user'-role operator coerce the control plane into making HTTP requests to internal, loopback, and link-local addresses by setting allow_private: true on their own webhook subscription. The missing authorization check in both the create and update webhook handlers (internal/api/webhooks.go) means the SSRF guard that protects all other tenants is silently bypassed at delivery time, exposing cloud metadata endpoints, internal APIs, or backend services reachable only from the server. A working proof-of-concept has been verified against a live instance; vendor-released patch v0.7.2 is available.