CVE-2026-53603: CWE-312: Cleartext Storage of Sensitive Information in forgekeep nebula-mesh
Description
A vulnerability in forgekeep nebula-mesh prior to version 0.3.8 allows cleartext storage of operator session tokens in the database. These tokens, used for operator authentication, are stored in plaintext in the operator_sessions table, enabling anyone with database read access to hijack active sessions without further authentication. The issue has been fixed in version 0.3.8.
CVSS v4.0
Score 7.1high
Affected software
forgekeep
nebula-mesh
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-53603 describes a cleartext storage vulnerability (CWE-312) in forgekeep nebula-mesh, a self-hosted control plane for Slack Nebula mesh VPN. Before version 0.3.8, operator session tokens, which are 32-byte random hex values valid for 24 hours and sent directly in cookies, were stored in plaintext in the operator_sessions table as the primary key. This allows an attacker with read access to the database (via backup, snapshot, file copy, or SQL-level disclosure) to obtain all active session tokens and hijack operator sessions without additional authentication. The vulnerability was patched in version 0.3.8.
Potential Impact
An attacker who can read the database can obtain all active operator session tokens and hijack operator sessions directly without needing further authentication. This compromises the confidentiality and integrity of operator sessions, potentially allowing unauthorized control over the nebula-mesh control plane.
Mitigation Recommendations
Upgrade to forgekeep nebula-mesh version 0.3.8 or later, where this vulnerability has been patched. No other mitigations are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-09T19:39:52.404Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9b218eacd9273b49299095
Added to database: 09/04/2026, 19:52:46 UTC
Last enriched: 09/15/2026, 00:52:41 UTC
Last updated: 10/17/2026, 18:48:20 UTC
Views: 88
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.