CVE-2026-63464: CWE-862: Missing Authorization in forgekeep nebula-mesh
Description
A missing authorization vulnerability in forgekeep nebula-mesh versions 0.6.0 through before 0.7.2 allows non-admin users to enable an unguarded HTTP client by setting the allow_private field on their webhook subscriptions. This bypasses internal SSRF protections and lets low-privilege operators make server requests to internal addresses. The issue is patched in version 0.7.2.
CVSS v3.1
Score 7.7high
Affected software
forgekeep
nebula-mesh
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In forgekeep nebula-mesh, a self-hosted control plane for Slack Nebula mesh VPN, versions from 0.6.0 up to but not including 0.7.2 contain a missing authorization flaw (CWE-862). Non-admin operators with the user role can set the allow_private field to true on their webhook subscriptions via POST or PATCH requests without admin checks. This causes the dispatcher to use an unguarded HTTP client at delivery time, bypassing SSRF protections for private, loopback, and link-local addresses (CWE-918). This enables low-privilege users to make internal server requests. The vulnerability is fixed in version 0.7.2.
Potential Impact
The vulnerability allows low-privilege users to bypass SSRF protections and make HTTP requests to internal network addresses, potentially exposing sensitive internal services or data. The CVSS score of 7.7 (high) reflects the network attack vector, low complexity, low privileges required, no user interaction, scope change, and high confidentiality impact. There is no impact on integrity or availability reported.
Mitigation Recommendations
Upgrade to forgekeep nebula-mesh version 0.7.2 or later, where this missing authorization vulnerability is patched. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-16T21:37:45.768Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a9b218eacd9273b4929908f
Added to database: 09/04/2026, 19:52:46 UTC
Last enriched: 09/15/2026, 00:52:12 UTC
Last updated: 10/18/2026, 06:48:18 UTC
Views: 83
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.