Executive brief
Headplane is a web-based management interface for Headscale networks. A security flaw allowed authenticated users to bypass access controls and perform unauthorized actions on other users' devices or accounts. By providing specially crafted names during a rename operation, an attacker could force the system to disconnect devices or rename resources they do not own, potentially disrupting network connectivity and administrative operations.
Technical details
A path traversal vulnerability exists in Headplane's Headscale API client due to improper sanitization of user-provided input in URL paths. When a user renames a node or user, the application embeds the new name directly into a URL string without URL-encoding. Because the underlying Node.js URL resolution normalizes path segments like '../', an attacker with low-level 'machine action' permissions can inject traversal sequences to redirect the authenticated API request to unauthorized endpoints. This allows an attacker to perform actions such as expiring arbitrary nodes or renaming other users and machines, leading to high integrity and availability impact. The issue is fixed in versions 0.6.3 and 0.7.0-beta.3 by applying encodeURIComponent to the affected path segments.
Affected products
- tale Headplane <= 0.6.2, 0.7.0-beta.1, 0.7.0-beta.2
Timeline
- 2026-05-14: patched: Versions 0.6.3 and 0.7.0-beta.3 released
- 2026-05-14: advisory: GitHub Security Advisory GHSA-vgj6-hcf2-fqf6 published
- 2026-06-08: disclosed: CVE-2026-46484 published to NVD