Most recent entries from all

EUVD-2026-342072

fkie_cve-2026-47724

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the `/api/v1/*` route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at `internal/api/hosts.go:384`: "API trusts the bearer token for authorisation; per-CA ownership is enforced only in the Web layer." The Web UI gates state-changing routes through `loadAccessibleCA` (`internal/web/cas.go`); CA-management endpoints in `internal/api/cas.go` ALSO have proper `canAccessCA` gates. The gap is on the host, network, firewall, mobile-bundle, and most operator endpoints. Combined with the per-operator CA model from ADR 0002, this gives any non-admin operator API key broad cross-tenant access — instant privilege escalation in the worst case. Version 0.3.4 fixes the issue.

GHSA-598g-h2vc-h5vg — nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation

Affected: Go: github.com/juev/nebula-mesh

The `/api/v1/*` route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at `internal/api/hosts.go:384`: *"API trusts the bearer token for authorisation; per-CA ownership is enforced only in the Web layer."*

The Web UI gates state-changing routes through `loadAccessibleCA` (`internal/web/cas.go`); CA-management endpoints in `internal/api/cas.go` ALSO have proper `canAccessCA` gates. **The gap is on the host, network, firewall, mobile-bundle, and most operator endpoints.** Combined with the per-operator CA model from ADR 0002, this gives any non-admin operator API key broad cross-tenant access — instant privilege escalation in the worst case.

## Affected All released versions prior to v0.3.4.

## Exploit chain

### A) Mint admin API key from any operator key (instant privilege escalation) `internal/api/operators.go:118` — `handleCreateOperatorAPIKey` does no admin check and no actor/target-operator ownership check. Any operator key can call it for any operator (including admins) and receive a fresh bearer.

``` curl -X POST -H "Authorization: Bearer <low-priv-key>" \ https://server/api/v1/operators/<admin-id>/api-keys \ -H 'Content-Type: application/json' -d '{"name":"oops"}' # Returns: {"key":"<32-byte admin bearer>","entry":{...}} ```

Reuse the returned key for subsequent requests → full admin.

### B) Cross-operator host takeover via reenroll `internal/api/hosts.go:321,330` → `mintEnrollmentTokenForHost`. Looks…