Access Control Vulnerability in Nebula Mesh VPN Affecting Operators
CVE-2026-49258

8.8HIGH

Key Information:

Vendor

Juev

Status
Nebula-mesh
Vendor
CVE Published:
28 July 2026

What is CVE-2026-49258?

Nebula Mesh, a self-hosted VPN control plane for Slack, contains a vulnerability in versions 0.3.5 and below where authenticated non-admin operators can access other operators' resources through the web UI. This flaw occurs due to the lack of proper scoping in resource access, allowing malicious operators to perform actions such as deleting or blocking hosts belonging to other users. The vulnerability has been addressed in version 0.3.6 of Nebula Mesh, which implements necessary access controls.

Affected Version(s)

nebula-mesh < 0.3.6

References

https://github.com/forgekeep/nebula-mesh/security/advisor...
x_refsource_CONFIRM
https://github.com/forgekeep/nebula-mesh/pull/161
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.