CVE-2026-55513: CWE-613: Insufficient Session Expiration in forgekeep nebula-mesh
Description
CVE-2026-55513 is a medium severity vulnerability in forgekeep nebula-mesh versions 0.3.0 up to but not including 0.5.0. The issue involves insufficient session expiration where the nebula-mgmt Web UI host-creation path ignores configured enrollment token TTL settings and instead hardcodes a 24-hour token lifetime. This allows authenticated operators who can create hosts via the Web UI to mint bearer enrollment tokens valid for about 24 hours, potentially longer than intended by security policies. The vulnerability has been patched in version 0.5.0.
CVSS v3.1
Score 5.4medium
Affected software
forgekeep
nebula-mesh
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in forgekeep nebula-mesh affects versions from 0.3.0 to before 0.5.0. The nebula-mgmt Web UI host-creation endpoint does not respect the server-wide or per-network enrollment_token_ttl settings, instead hardcoding a 24-hour TTL for newly created agent enrollment tokens. While API host creation and token regeneration paths correctly use the configured TTL, the Web UI path allows tokens to live longer than intended in deployments that reduce token lifetime. This constitutes insufficient session expiration (CWE-613). The issue is fixed in version 0.5.0.
Potential Impact
An authenticated operator with access to the Web UI host-creation functionality can create bearer enrollment tokens with a fixed 24-hour lifetime regardless of configured shorter TTLs. This may allow longer-than-intended token validity, increasing the window for potential misuse of these tokens. The impact is limited to confidentiality and integrity with no availability impact. There are no known exploits in the wild.
Mitigation Recommendations
Upgrade to forgekeep nebula-mesh version 0.5.0 or later, where this issue has been patched. Until upgrade, be aware that enrollment tokens created via the Web UI host-creation path will have a fixed 24-hour TTL regardless of configured settings.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-16T22:44:22.283Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a9b218eacd9273b4929908b
Added to database: 09/04/2026, 19:52:46 UTC
Last enriched: 09/15/2026, 00:54:16 UTC
Last updated: 10/18/2026, 06:48:18 UTC
Views: 79
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.