Executive brief
Nebula-mesh is a management tool for Slack Nebula virtual private networks, used to control security settings and access keys. A security flaw in the web interface allows attackers to trick authenticated administrators into performing unintended actions, such as deleting security certificates or disabling users, by visiting a malicious website. This could lead to unauthorized access to the network or a disruption of secure communications.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in nebula-mesh versions prior to 0.3.3 because the /ui/* routes (POST, PUT, PATCH, DELETE) lack CSRF token validation. While the session cookie uses SameSite=Lax, it does not protect against top-level form submissions from third-party pages or attacks from sibling subdomains. An attacker can exploit this to perform sensitive operations such as signing CA certificates, minting API keys, or deleting CAs. Additionally, the logout route was accessible via a GET request, allowing for forced logout via simple image tags. Version 0.3.3 introduces double-submit cookie protection and converts the logout route to a POST request.
Affected products
- juev nebula-mesh < 0.3.3
Timeline
- 2026-05-22: patched: Version 0.3.3 released
- 2026-07-28: disclosed: CVE-2026-47725 published