Is CVE-2026-47768 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47768 being exploited in the wild.

How severe is CVE-2026-47768?

Medium severity, with a CVSS score of 5.5, published 28 July 2026.

Which products and versions are affected?

github.com/juev/nebula-mesh (Go) <= 0.3.1, SEMVER:introduced=0,fixed=0.3.2.

Is there a fix for CVE-2026-47768?

Yes. github.com/juev/nebula-mesh (Go): upgrade to 0.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47768 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-47768?

Check whether you run Forgekeep Nebula-Mesh or github.com/juev/nebula-mesh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47768: juev nebula-mesh API key exposure via sensitive query strings

Q: Is there a fix for CVE-2026-47768?

Yes. github.com/juev/nebula-mesh (Go): upgrade to 0.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-47768 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-47768?

Check whether you run Forgekeep Nebula-Mesh or github.com/juev/nebula-mesh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47768 · Severity: medium · CVSS 5.5 · Published 2026-07-28

nebula-mesh is a management tool for Slack Nebula virtual private networks. A security flaw in the administrative interface causes newly created API keys to be included directly in the web browser's address bar during a redirect. This results in sensitive credentials being recorded in browser history, server logs, and potentially shared with third-party websites via web headers, allowing anyone with access to those logs to impersonate an administrator.

Technologies: Forgekeep Nebula-Mesh, github.com/juev/nebula-mesh (Go). Vendors: Forgekeep, Go.

Quick answers

Is CVE-2026-47768 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47768 being exploited in the wild.
How severe is CVE-2026-47768?: Medium severity, with a CVSS score of 5.5, published 28 July 2026.
Which products and versions are affected?: github.com/juev/nebula-mesh (Go) <= 0.3.1, SEMVER:introduced=0,fixed=0.3.2.
Is there a fix for CVE-2026-47768?: Yes. github.com/juev/nebula-mesh (Go): upgrade to 0.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47768 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-47768?: Check whether you run Forgekeep Nebula-Mesh or github.com/juev/nebula-mesh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/juev/nebula-mesh (Go): upgrade to 0.3.2 or later
```
go get github.com/juev/nebula-mesh@v0.3.2
```

Technical details

The vulnerability exists in `internal/web/operators.go` within the `handleOperatorCreateAPIKey` function. When a new 32-byte bearer token is generated, the application issues a 303 redirect that includes the raw API key as a query parameter (`new_key`). This violates secure coding practices by placing sensitive credentials in the URL, where they are captured by browser history, reverse-proxy access logs (like Nginx), and transmitted in the `Referer` header to any cross-origin assets loaded on the subsequent page. Additionally, the `name` parameter was found to be missing proper URL encoding, potentially allowing for query string corruption. The issue is addressed in version 0.3.2 by removing the key from the redirect URL.

Affected products

juev nebula-mesh < 0.3.2

Identifiers

CVE-2026-47768
GHSA-9pg3-25fq-p6cc
GO-2026-5294

Timeline

2026-05-21: patched: Version 0.3.2 released
2026-05-21: advisory: GitHub Security Advisory GHSA-9pg3-25fq-p6cc published
2026-07-28: disclosed: CVE-2026-47768 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.