CVE-2026-49258: CWE-639: Authorization Bypass Through User-Controlled Key in juev nebula-mesh
Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI (/ui/*) does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5vg, but the changes were not implemented in the web read/mutation surface. Any authenticated non-admin operator (for example, one created via self-registration or OIDC) can access resources belonging to other operators. The host create/edit/mobile-bundle/network-create paths and all CA-management routes were already correctly scoped. A malicious operator could block or delete any other operator's host, or read any operator's hosts and networks. This issue has been fixed in version 0.3.6.
AI Analysis
Technical Summary
CVE-2026-49258 is an authorization bypass vulnerability in juev's Nebula Mesh product affecting versions 0.3.5 and earlier. The web UI endpoints under /ui/* do not enforce the per-operator CA scoping that is applied in the JSON API, allowing authenticated non-admin operators to access, modify, or delete hosts and networks belonging to other operators. Although some paths such as host create/edit and CA management were correctly scoped, the web read and mutation surfaces were not. This vulnerability was partially addressed in a previous advisory (GHSA-598g-h2vc-h5vg) but not fully remediated until version 0.3.6.
Potential Impact
An authenticated non-admin operator can bypass authorization controls to read, modify, or delete hosts and networks of other operators. This compromises confidentiality, integrity, and availability of operator resources within the Nebula Mesh environment. The CVSS score of 8.8 reflects high impact with network attack vector, low attack complexity, and no user interaction required.
Mitigation Recommendations
Upgrade to Nebula Mesh version 0.3.6 or later, where this authorization bypass vulnerability has been fixed. No other mitigation or temporary workaround is indicated in the available data.
CVE-2026-49258: CWE-639: Authorization Bypass Through User-Controlled Key in juev nebula-mesh
Description
Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI (/ui/*) does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5vg, but the changes were not implemented in the web read/mutation surface. Any authenticated non-admin operator (for example, one created via self-registration or OIDC) can access resources belonging to other operators. The host create/edit/mobile-bundle/network-create paths and all CA-management routes were already correctly scoped. A malicious operator could block or delete any other operator's host, or read any operator's hosts and networks. This issue has been fixed in version 0.3.6.
CVSS v3.1
Score 8.8high
Affected software
juev
nebula-mesh
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-49258 is an authorization bypass vulnerability in juev's Nebula Mesh product affecting versions 0.3.5 and earlier. The web UI endpoints under /ui/* do not enforce the per-operator CA scoping that is applied in the JSON API, allowing authenticated non-admin operators to access, modify, or delete hosts and networks belonging to other operators. Although some paths such as host create/edit and CA management were correctly scoped, the web read and mutation surfaces were not. This vulnerability was partially addressed in a previous advisory (GHSA-598g-h2vc-h5vg) but not fully remediated until version 0.3.6.
Potential Impact
An authenticated non-admin operator can bypass authorization controls to read, modify, or delete hosts and networks of other operators. This compromises confidentiality, integrity, and availability of operator resources within the Nebula Mesh environment. The CVSS score of 8.8 reflects high impact with network attack vector, low attack complexity, and no user interaction required.
Mitigation Recommendations
Upgrade to Nebula Mesh version 0.3.6 or later, where this authorization bypass vulnerability has been fixed. No other mitigation or temporary workaround is indicated in the available data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-28T14:33:01.179Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a68fdfd9c2644c7f8116823
Added to database: 07/28/2026, 19:07:41 UTC
Last enriched: 07/29/2026, 14:39:39 UTC
Last updated: 09/10/2026, 20:01:05 UTC
Views: 74
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.