CVE-2026-63464 Details
Description
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators (role user) can set allow_private: true on their own managed webhook subscription (POST/PATCH /api/v1/webhook-subscriptions). No admin check exists on this field. At delivery time, allow_private switches the dispatcher to an unguarded HTTP client, bypassing the private/loopback/link-local SSRF guard — letting a low-privilege operator make the server request internal addresses. This issue has been patched in version 0.7.2.
A vulnerability in Nebula Mesh versions 0.6.0 prior to 0.7.2 allows non-admin operators to bypass webhook delivery safeguards. By setting 'allow_private' to true on their webhook subscriptions, these operators can disable protections against server-side request forgery (SSRF) for private or loopback addresses. This exploitation enables low-privilege users to make internal requests from the server, potentially probing internal services or accessing sensitive metadata in cloud environments.
Users are advised to update to Nebula Mesh version 0.7.2 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 4, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-7rx3-5wx3-5v76 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/forgekeep/nebula-mesh/commit/f3c54530e388dd21763e548923426e60a8e93ff0 | [email protected] | Source CodeVendor |
| https://github.com/forgekeep/nebula-mesh/releases/tag/v0.7.2 | [email protected] | Release NotesVendor |
| https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-7rx3-5wx3-5v76 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| forgekeep nebula-mesh | >= 0.6.0, <= 0.7.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 4, 2026 | New CVE Received | [email protected] |