EUVD-2026-342176

fkie_cve-2026-47726

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via store.ListAuditEntries (up to limit=1000). This includes cross-tenant actor names, host/CA/operator IDs, action timestamps, and masked-IP entries from rate-limit refusals — enough surface for a tenant to enumerate the server's activity, infer staffing patterns, or identify high-value targets. This issue has been patched in version 0.3.2.

GHSA-qm33-p5p9-f8vg — nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator

Affected: Go: github.com/juev/nebula-mesh

`internal/api/audit.go:12` — `handleGetAuditLog` does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via `store.ListAuditEntries` (up to limit=1000). This includes cross-tenant actor names, host/CA/operator IDs, action timestamps, and masked-IP entries from rate-limit refusals — enough surface for a tenant to enumerate the server's activity, infer staffing patterns, or identify high-value targets.

## Affected All released versions up to v0.3.1.

## Reproducer ``` curl -H "Authorization: Bearer <any-operator-key>" \ https://server/api/v1/audit-log?limit=1000 ```

## Suggested fix Two options, either acceptable:

1. `if !actorIsAdmin(ctx) { 403 }` — strictest; matches the "operator management is admin-only" stance. 2. Scope to actor: filter `store.ListAuditEntries` by `actor.Username` plus a subquery of CA IDs the actor owns. Operators see their own audit entries plus entries against their CA's resources.

Recommend option 1 unless the UI needs per-operator audit views.

## Suggested patch

Verified locally: `go vet`, `go test -race -count=1 ./...`, `golangci-lint v2.12` all clean.

```diff diff --git a/internal/api/audit.go b/internal/api/audit.go index 3236631..57b57ce 100644 --- a/internal/api/audit.go +++ b/internal/api/audit.go @@ -10,6 +10,10 @@ import ( const defaultAuditLimit = 100 func (s *Server) handleGetAuditLog(w http.ResponseWriter, r *http.Request) { + if !actorIsAdmin(r.Context()) { + writeError(w, h…

Most recent entries from all

EUVD-2026-342176

fkie_cve-2026-47726

GHSA-qm33-p5p9-f8vg — nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator