https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 06:30:44 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-340498 EUVD-2026-340498 https://cve.radiocsirt.org/vuln/euvd-2026-340498 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47722 <p>nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, `internal/configgen/generator.go:86,108,119` interpolates the operator-supplied `ListenHost` and `TunDevice` fields raw into a `text/template` that produces the agent&#39;s `config.yml`. `internal/web/advanced.go:20-35` accepts both with only `strings.TrimSpace` — no character or shape validation. Version 0.3.2 fixes the issue.</p> <p>nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, `internal/configgen/generator.go:86,108,119` interpolates the operator-supplied `ListenHost` and `TunDevice` fields raw into a `text/template` that produces the agent&#39;s `config.yml`. `internal/web/advanced.go:20-35` accepts both with only `strings.TrimSpace` — no character or shape validation. Version 0.3.2 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-47722 https://cve.radiocsirt.org/vuln/ghsa-7hp6-g3pq-3pc3 <p><strong>Affected:</strong> Go: github.com/juev/nebula-mesh</p> <p>`internal/configgen/generator.go:86,108,119` interpolates the operator-supplied `ListenHost` and `TunDevice` fields raw into a `text/template` that produces the agent&#39;s `config.yml`. `internal/web/advanced.go:20-35` accepts both with only `strings.TrimSpace` — no character or shape validation.</p> <p>## Exploit An operator (or attacker with any operator key, given the cross-tenant CRUD advisory) sets `adv_tun_device` to:</p> <p>``` nebula0 lighthouse: am_lighthouse: true hosts: [&#34;10.0.0.1&#34;] # ```</p> <p>The agent fetches the rendered config on its next signed poll. On config reload, it loads the injected YAML keys: the host self-promotes to lighthouse, attracts mesh traffic, or sets `am_relay: true` to be selected as a relay. The `ListenHost` field has the same shape.</p> <p>## Affected All released versions prior to v0.3.2.</p> <p>## Threat model - **Today**: operator can compromise their own host&#39;s config (trivially allowed if they own the host, but they can also set lighthouse/relay flags that the operator-create form does NOT expose — privilege uplift within their own tenant). - **Combined with the critical /api/v1 authz advisory**: any operator key can mutate ANOTHER tenant&#39;s host overrides and inject YAML there. - **Post-fix of the authz advisory**: still relevant — the agent unconditionally trusts whatever config the server hands it, so any future operator-impersonation bug re-amplifies this.</p> <p>## Suggested fix Two options, either acceptable:</p> <p>1. **Input validation** in `parseAdvancedFromForm`…</p> <p><strong>Affected:</strong> Go: github.com/juev/nebula-mesh</p> <p>`internal/configgen/generator.go:86,108,119` interpolates the operator-supplied `ListenHost` and `TunDevice` fields raw into a `text/template` that produces the agent&#39;s `config.yml`. `internal/web/advanced.go:20-35` accepts both with only `strings.TrimSpace` — no character or shape validation.</p> <p>## Exploit An operator (or attacker with any operator key, given the cross-tenant CRUD advisory) sets `adv_tun_device` to:</p> <p>``` nebula0 lighthouse: am_lighthouse: true hosts: [&#34;10.0.0.1&#34;] # ```</p> <p>The agent fetches the rendered config on its next signed poll. On config reload, it loads the injected YAML keys: the host self-promotes to lighthouse, attracts mesh traffic, or sets `am_relay: true` to be selected as a relay. The `ListenHost` field has the same shape.</p> <p>## Affected All released versions prior to v0.3.2.</p> <p>## Threat model - **Today**: operator can compromise their own host&#39;s config (trivially allowed if they own the host, but they can also set lighthouse/relay flags that the operator-create form does NOT expose — privilege uplift within their own tenant). - **Combined with the critical /api/v1 authz advisory**: any operator key can mutate ANOTHER tenant&#39;s host overrides and inject YAML there. - **Post-fix of the authz advisory**: still relevant — the agent unconditionally trusts whatever config the server hands it, so any future operator-impersonation bug re-amplifies this.</p> <p>## Suggested fix Two options, either acceptable:</p> <p>1. **Input validation** in `parseAdvancedFromForm`…</p> https://cve.radiocsirt.org/vuln/ghsa-7hp6-g3pq-3pc3