CVE-2026-47725 Details

A cross-site request forgery (CSRF) vulnerability has been identified in Nebula Mesh versions prior to 0.3.3. The issue arises because the application processes requests to mutating endpoints in the admin UI as soon as the session cookie is validated, without additional checks. While the session cookie has a SameSite=Lax attribute that prevents most cross-site form submissions, it does not protect against top-level form submissions from third-party pages, same-registrable-domain attacks (such as sibling-subdomain cross-site scripting or subdomain takeover), or the GET /ui/logout route, which can be triggered by a third-party image tag. This vulnerability allows for privilege escalation, as the admin UI can be manipulated to delete certificate authorities, mint API keys, and alter server settings.

Users can update to Nebula Mesh version 0.3.3 or later, where this vulnerability has been patched. The update includes added CSRF protection on mutating endpoints, requiring a CSRF token to be submitted with requests. The /ui/logout route has also been changed to a POST endpoint, preventing it from being triggered by an image tag.