Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the `/api/v1/*` route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at `internal/api/hosts.go:384`: "API trusts the bearer token for authorisation; per-CA ownership is enforced only in the Web layer." The Web UI gates state-changing routes through `loadAccessibleCA` (`internal/web/cas.go`); CA-management endpoints in `internal/api/cas.go` ALSO have proper `canAccessCA` gates. The gap is on the host, network, firewall, mobile-bundle, and most operator endpoints. Combined with the per-operator CA model from ADR 0002, this gives any non-admin operator API key broad cross-tenant access — instant privilege escalation in the worst case. Version 0.3.4 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-09 | 1 | Patch1 |
| 2026-07-24 | 2 | Disclosure1Patch1 |
| 2026-07-29 | 1 | Disclosure1 |
CVE-2026-47724 exposes broad cross-tenant access in juev nebula-mesh prior to version 0․3․4, allowing non-admin operators to escalate privileges. https://ift.tt/2tUlI9o
Post summary
CVE-2026-47724 enables cross-tenant access and non-admin privilege escalation in juev nebula-mesh before version 0.3.4. No PoC, exploit, or patch information is provided.
🚨*CVE* CVE-2026-47724 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the `/api/v1/*` route surface trusts the bearer toke… https://www.cve.org/CVERecord?id=CVE-2026-47724 ----- Traducción: CVE-2026-47724 neb… http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-47724, a flaw in Nebula Mesh's control plane where versions prior to 0.3.4 incorrectly trust bearer tokens on /api/v1/* routes.
CVE-2026-47724 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the `/api/v1/*` route surface trusts the bearer toke… https://www.cve.org/CVERecord?id=CVE-2026-47724
Post summary
The CVE involves Nebula Mesh’s `/api/v1/*` endpoint trusting bearer tokens and is mitigated by upgrading to version 0.3.4.
🚨 Critical - Nebula-Mesh Cross-Tenant Privilege Escalation (CVE-2026-47724) A critical authorization gap in the nebula-mesh API (/api/v1/*) allows non-admin operators to gain broad, cross-tenant access. Because the host, network, and firewall endpoints trust the bearer token alone without enforcing ownership checks, any valid operator key can achieve instant privilege escalation. 👉 Insecure direct object reference (IDOR) / Broken Object Level Authorization (BOLA) | Review API token permissions and restrict cross-operator access immediately https://advisories.gitlab.com/golang/github.com/juev/nebula-mesh/CVE-2026-47724/
Post summary
The advisory discloses CVE‑2026‑47724, a cross‑tenant privilege escalation in Nebula‑Mesh, and recommends reviewing API token permissions as a temporary mitigation until a patch is issued.