Unauthenticated Access Vulnerability in Nebula Mesh VPN Control Plane

CVE-2026-55512

What is CVE-2026-55512?

An issue in the Nebula Mesh VPN control plane allows unauthenticated remote clients to access the OIDC login endpoint due to improper authentication measures. The vulnerability arises from a lack of rate limiting on the GET /ui/oidc/login endpoint when the OpenID Connect (OIDC) feature is enabled. Specifically, any remote request can generate new OIDC state values without restrictions, potentially leading to resource exhaustion. This vulnerability has been resolved in version 0.5.0, which implements necessary rate limits and security best practices.

References