CVE-2026-47723: juev nebula-mesh missing security headers in Web UI and API

CVE-2026-47723 · Severity: high · CVSS 4 · Published 2026-07-23

nebula-mesh is a management tool for Slack Nebula virtual private networks, used to manage security certificates and user access. A security flaw was found where the application's web interface failed to use standard browser security protections. This could allow attackers to perform clickjacking attacks, where an administrator is tricked into performing unintended actions like deleting users or changing security settings, or lead to the exposure of sensitive information like API keys and security codes.

Technologies: Forgekeep Nebula-Mesh, github.com/juev/nebula-mesh (Go). Vendors: Forgekeep, Go.

Quick answers

Is CVE-2026-47723 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47723 being exploited in the wild.
How severe is CVE-2026-47723?
High severity, with a CVSS score of 4, published 23 July 2026.
Which products and versions are affected?
Forgekeep Nebula-Mesh <= 0.3.0; github.com/juev/nebula-mesh (Go) <= 0.3.0, SEMVER:introduced=0,fixed=0.3.1.
Is there a fix for CVE-2026-47723?
Yes. github.com/juev/nebula-mesh (Go): upgrade to 0.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47723 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-47723?
Check whether you run Forgekeep Nebula-Mesh or github.com/juev/nebula-mesh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/juev/nebula-mesh (Go): upgrade to 0.3.1 or later
    go get github.com/juev/nebula-mesh@v0.3.1

Technical details

nebula-mesh prior to version 0.3.1 lacks essential HTTP security headers across all response paths in its web and API components. Specifically, the absence of X-Frame-Options and Content-Security-Policy (frame-ancestors) makes the admin UI vulnerable to clickjacking, which is particularly critical as the interface handles CA certificate signing and API key generation. Additionally, the lack of X-Content-Type-Options allows for potential MIME confusion attacks, and the absence of Strict-Transport-Security (HSTS) leaves the application susceptible to protocol downgrade attacks. The vulnerability was addressed in version 0.3.1 by implementing a middleware that applies these headers to all responses.

Affected products

  • juev nebula-mesh < 0.3.1

Identifiers

  • CVE-2026-47723
  • GHSA-w7w5-5gcp-38rw
  • GO-2026-5698

Timeline

  • 2026-05-20: advisory: GitHub Security Advisory published
  • 2026-05-20: patched: Version 0.3.1 released
  • 2026-07-23: disclosed: CVE-2026-47723 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.