Vulnerability in Nebula-Mesh Control Plane for Slack - Bypass of SSRF Guard
CVE-2026-63464

7.7HIGH

Key Information:

Vendor

Forgekeep

Status
Nebula-mesh
Vendor
CVE Published:
4 September 2026

What is CVE-2026-63464?

A vulnerability in the Nebula-Mesh control plane, particularly affecting versions 0.6.0 through 0.7.0, allows non-admin operators to manipulate their webhook subscriptions. By setting the 'allow_private' flag to true without any administrative validation, these operators can make unauthorized server requests to internal network addresses. This breaks established security measures designed to prevent SSRF attacks, putting sensitive internal systems at risk. The issue was addressed in version 0.7.2.

Affected Version(s)

nebula-mesh >= 0.6.0, < 0.7.2

References

https://github.com/forgekeep/nebula-mesh/security/advisor...
x_refsource_CONFIRM
https://github.com/forgekeep/nebula-mesh/commit/f3c54530e...
x_refsource_MISC
https://github.com/forgekeep/nebula-mesh/releases/tag/v0.7.2
x_refsource_MISC

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.