CVE-2026-48058 Details

A vulnerability exists in Nebula Mesh versions prior to 0.3.2, where the application fails to set the Secure attribute on session cookies. Instead, it only applies HttpOnly and SameSite=Lax attributes. This oversight allows an attacker to intercept the session cookie through a plaintext HTTP request, such as via a mistyped URL or a reverse proxy misconfiguration. The exposed session cookie can be used to impersonate the operator for the duration of its 24-hour lifetime. Additionally, the OIDC state cookie, which has a shorter 10-minute lifespan, can be exploited to perform Cross-Site Request Forgery (CSRF) attacks on the OIDC callback during that window.

Users can upgrade to Nebula Mesh version 0.3.2 or later, where this vulnerability has been patched. For those who need to maintain an earlier version, the 'cookie_secure' configuration option can be manually set to 'true' when behind a TLS-terminating proxy, ensuring that the session cookies are transmitted securely.