https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 06:19:30 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-342210 EUVD-2026-342210 https://cve.radiocsirt.org/vuln/euvd-2026-342210 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47725 <p>nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/* POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits but does not protect: top-level form-submit navigations from third-party pages (some browsers still send Lax cookies on top-level POSTs); same-registrable-domain attackers (sibling-subdomain XSS, subdomain takeover); the GET /ui/logout route, which a third-party &lt;img src=&#34;.../ui/logout&#34;&gt; can force-trigger. This issue has been patched in version 0.3.3.</p> <p>nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/* POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits but does not protect: top-level form-submit navigations from third-party pages (some browsers still send Lax cookies on top-level POSTs); same-registrable-domain attackers (sibling-subdomain XSS, subdomain takeover); the GET /ui/logout route, which a third-party &lt;img src=&#34;.../ui/logout&#34;&gt; can force-trigger. This issue has been patched in version 0.3.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-47725 https://cve.radiocsirt.org/vuln/ghsa-273q-qgh5-wrj6 <p><strong>Affected:</strong> Go: github.com/juev/nebula-mesh</p> <p>Every `/ui/*` POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. `SameSite=Lax` on the session cookie prevents most cross-site form submits but does not protect:</p> <p>- top-level form-submit navigations from third-party pages (some browsers still send Lax cookies on top-level POSTs) - same-registrable-domain attackers (sibling-subdomain XSS, subdomain takeover) - the `GET /ui/logout` route, which a third-party `&lt;img src=&#34;.../ui/logout&#34;&gt;` can force-trigger</p> <p>The admin UI signs CA certificates, mints API keys, rotates / retires / deletes CAs, disables operators, and changes server settings. CSRF here is a real privilege escalation, not just annoyance.</p> <p>## Affected All released versions up to v0.3.2.</p> <p>## Suggested fix Double-submit cookie: a 32-byte `crypto/rand` token in a non-HttpOnly `_csrf` cookie, echoed in either `X-CSRF-Token` (htmx) or a `_csrf` form field (HTML forms). Compared in constant time. Rotated on every privilege transition (`Login`, OIDC `StartAuthenticatedSession`, `CompleteTwoFactor`, `Logout`) so pre-auth fixation cannot survive promotion. Rejections audit-logged as `ui.csrf.rejected` with reason; response body stays opaque.</p> <p>`/ui/logout` becomes POST so it is no longer reachable via `&lt;img&gt;` tags.</p> <p>Fix coordinates with the Secure-cookie advisory disclosed concurrently — the `_csrf` cookie inherits the same `Secure`-attribute derivation.</p> <p>## Reproducer With an authenticated operator session in browser tab A, open the…</p> <p><strong>Affected:</strong> Go: github.com/juev/nebula-mesh</p> <p>Every `/ui/*` POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. `SameSite=Lax` on the session cookie prevents most cross-site form submits but does not protect:</p> <p>- top-level form-submit navigations from third-party pages (some browsers still send Lax cookies on top-level POSTs) - same-registrable-domain attackers (sibling-subdomain XSS, subdomain takeover) - the `GET /ui/logout` route, which a third-party `&lt;img src=&#34;.../ui/logout&#34;&gt;` can force-trigger</p> <p>The admin UI signs CA certificates, mints API keys, rotates / retires / deletes CAs, disables operators, and changes server settings. CSRF here is a real privilege escalation, not just annoyance.</p> <p>## Affected All released versions up to v0.3.2.</p> <p>## Suggested fix Double-submit cookie: a 32-byte `crypto/rand` token in a non-HttpOnly `_csrf` cookie, echoed in either `X-CSRF-Token` (htmx) or a `_csrf` form field (HTML forms). Compared in constant time. Rotated on every privilege transition (`Login`, OIDC `StartAuthenticatedSession`, `CompleteTwoFactor`, `Logout`) so pre-auth fixation cannot survive promotion. Rejections audit-logged as `ui.csrf.rejected` with reason; response body stays opaque.</p> <p>`/ui/logout` becomes POST so it is no longer reachable via `&lt;img&gt;` tags.</p> <p>Fix coordinates with the Secure-cookie advisory disclosed concurrently — the `_csrf` cookie inherits the same `Secure`-attribute derivation.</p> <p>## Reproducer With an authenticated operator session in browser tab A, open the…</p> https://cve.radiocsirt.org/vuln/ghsa-273q-qgh5-wrj6