# CVE-2026-47723: juev nebula-mesh missing security headers in Web UI and API

Source: https://junglewise.ai/threats/cve-2026-47723-juev-nebula-mesh-missing-security-headers-in-web-ui-and-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-47723 · Severity: high · CVSS 4 · Published 2026-07-23

nebula-mesh is a management tool for Slack Nebula virtual private networks, used to manage security certificates and user access. A security flaw was found where the application's web interface failed to use standard browser security protections. This could allow attackers to perform clickjacking attacks, where an administrator is tricked into performing unintended actions like deleting users or changing security settings, or lead to the exposure of sensitive information like API keys and security codes.

Technologies: [Forgekeep Nebula-Mesh](https://junglewise.ai/threats/technologies/nebula-mesh), [github.com/juev/nebula-mesh (Go)](https://junglewise.ai/threats/technologies/github-com-juev-nebula-mesh). Vendors: [Forgekeep](https://junglewise.ai/threats/vendors/forgekeep), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-47723 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47723 being exploited in the wild.

**How severe is CVE-2026-47723?** High severity, with a CVSS score of 4, published 23 July 2026.

**Which products and versions are affected?** Forgekeep Nebula-Mesh <= 0.3.0; github.com/juev/nebula-mesh (Go) <= 0.3.0, SEMVER:introduced=0,fixed=0.3.1.

**Is there a fix for CVE-2026-47723?** Yes. github.com/juev/nebula-mesh (Go): upgrade to 0.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47723 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-47723?** Check whether you run Forgekeep Nebula-Mesh or github.com/juev/nebula-mesh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/juev/nebula-mesh (Go): upgrade to 0.3.1 or later

  ```sh
  go get github.com/juev/nebula-mesh@v0.3.1
  ```


## Technical details

nebula-mesh prior to version 0.3.1 lacks essential HTTP security headers across all response paths in its web and API components. Specifically, the absence of X-Frame-Options and Content-Security-Policy (frame-ancestors) makes the admin UI vulnerable to clickjacking, which is particularly critical as the interface handles CA certificate signing and API key generation. Additionally, the lack of X-Content-Type-Options allows for potential MIME confusion attacks, and the absence of Strict-Transport-Security (HSTS) leaves the application susceptible to protocol downgrade attacks. The vulnerability was addressed in version 0.3.1 by implementing a middleware that applies these headers to all responses.

## Affected products

- juev nebula-mesh < 0.3.1

## Identifiers

- CVE-2026-47723
- GHSA-w7w5-5gcp-38rw
- GO-2026-5698

## Timeline

- 2026-05-20: advisory: GitHub Security Advisory published
- 2026-05-20: patched: Version 0.3.1 released
- 2026-07-23: disclosed: CVE-2026-47723 published to NVD

## References

- [https://github.com/forgekeep/nebula-mesh/commit/b45fda5476c41ffcff1ca23058aef0fb851359c1](https://github.com/forgekeep/nebula-mesh/commit/b45fda5476c41ffcff1ca23058aef0fb851359c1)
- [https://github.com/forgekeep/nebula-mesh/releases/tag/v0.3.1](https://github.com/forgekeep/nebula-mesh/releases/tag/v0.3.1)
- [https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-w7w5-5gcp-38rw](https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-w7w5-5gcp-38rw)

## Related threats

- [forgekeep nebula-mesh certificate revocation failure in agent](https://junglewise.ai/threats/cve-2026-61699-forgekeep-nebula-mesh-certificate-revocation-failure-in-agent)
- [forgekeep nebula-mesh insufficient session expiration in Web UI host creation](https://junglewise.ai/threats/cve-2026-55513-forgekeep-nebula-mesh-insufficient-session-expiration-in-web-ui)
- [forgekeep nebula-mesh resource exhaustion in OIDC login](https://junglewise.ai/threats/cve-2026-55512-forgekeep-nebula-mesh-resource-exhaustion-in-oidc-login)
- [forgekeep nebula-mesh cleartext storage of CA private key in memory](https://junglewise.ai/threats/cve-2026-53604-forgekeep-nebula-mesh-cleartext-storage-of-ca-private-key-in)
- [forgekeep nebula-mesh plaintext storage of operator session tokens](https://junglewise.ai/threats/cve-2026-53603-forgekeep-nebula-mesh-plaintext-storage-of-operator-session)