The juev nebula-mesh control plane for Slack Nebula mesh VPN versions before 0.3.3 are vulnerable to CSRF attacks on all /ui/* POST, PUT, PATCH, and DELETE endpoints. The session cookie is set with SameSite=Lax, which mitigates many CSRF vectors but does not prevent top-level POST navigations from third-party sites, attacks from sibling subdomains or subdomain takeovers, or forced logout via an image tag triggering the GET /ui/logout route. This vulnerability allows unauthorized state-changing requests to be executed if a user is authenticated. The vulnerability was addressed and patched in version 0.3.3.

An attacker can cause an authenticated user to perform unintended state-changing actions on the nebula-mesh control plane, such as modifying or deleting resources via POST, PUT, PATCH, or DELETE requests. Additionally, the GET /ui/logout route can be triggered by third-party sites to log out users without their consent. This could lead to disruption of service or unauthorized changes within the control plane. The CVSS 4.0 base score is 6.9 (medium severity), indicating a significant but not critical risk.

Upgrade to juev nebula-mesh version 0.3.3 or later, where this CSRF vulnerability has been patched. No other official remediation or temporary fixes are indicated. Until upgrading, be aware of the risk from cross-site requests and consider additional protective measures such as implementing CSRF tokens or restricting access to sensitive endpoints.