Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via store.ListAuditEntries (up to limit=1000). This includes cross-tenant actor names, host/CA/operator IDs, action timestamps, and masked-IP entries from rate-limit refusals — enough surface for a tenant to enumerate the server's activity, infer staffing patterns, or identify high-value targets. This issue has been patched in version 0.3.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-47726 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog does no… https://www.cve.org/CVERecord?id=CVE-2026-47726
Post summary
This statement announces CVE-2026-47726 as a flaw in nebula-mesh before version 0.3.2, providing a code reference but no exploit, patch, or evidence of active exploitation.
🚨*CVE* CVE-2026-47726 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog does no… https://www.cve.org/CVERecord?id=CVE-2026-47726 ----- Traducción: CVE-2026-47726 neb… http://infoflow.cloud`
Post summary
The post alerts about CVE‑2026‑47726 affecting nebula‑mesh before version 0.3.2 and links to the CVE record, but provides no proof of concept, exploit, or remediation details.