# CVE-2026-47768: juev nebula-mesh API key exposure via sensitive query strings

Source: https://junglewise.ai/threats/cve-2026-47768-juev-nebula-mesh-api-key-exposure-via-sensitive-query-strings  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-47768 · Severity: medium · CVSS 5.5 · Published 2026-07-28

nebula-mesh is a management tool for Slack Nebula virtual private networks. A security flaw in the administrative interface causes newly created API keys to be included directly in the web browser's address bar during a redirect. This results in sensitive credentials being recorded in browser history, server logs, and potentially shared with third-party websites via web headers, allowing anyone with access to those logs to impersonate an administrator.

Technologies: [Forgekeep Nebula-Mesh](https://junglewise.ai/threats/technologies/nebula-mesh), [github.com/juev/nebula-mesh (Go)](https://junglewise.ai/threats/technologies/github-com-juev-nebula-mesh). Vendors: [Forgekeep](https://junglewise.ai/threats/vendors/forgekeep), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-47768 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47768 being exploited in the wild.

**How severe is CVE-2026-47768?** Medium severity, with a CVSS score of 5.5, published 28 July 2026.

**Which products and versions are affected?** github.com/juev/nebula-mesh (Go) <= 0.3.1, SEMVER:introduced=0,fixed=0.3.2.

**Is there a fix for CVE-2026-47768?** Yes. github.com/juev/nebula-mesh (Go): upgrade to 0.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47768 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-47768?** Check whether you run Forgekeep Nebula-Mesh or github.com/juev/nebula-mesh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/juev/nebula-mesh (Go): upgrade to 0.3.2 or later

  ```sh
  go get github.com/juev/nebula-mesh@v0.3.2
  ```


## Technical details

The vulnerability exists in `internal/web/operators.go` within the `handleOperatorCreateAPIKey` function. When a new 32-byte bearer token is generated, the application issues a 303 redirect that includes the raw API key as a query parameter (`new_key`). This violates secure coding practices by placing sensitive credentials in the URL, where they are captured by browser history, reverse-proxy access logs (like Nginx), and transmitted in the `Referer` header to any cross-origin assets loaded on the subsequent page. Additionally, the `name` parameter was found to be missing proper URL encoding, potentially allowing for query string corruption. The issue is addressed in version 0.3.2 by removing the key from the redirect URL.

## Affected products

- juev nebula-mesh < 0.3.2

## Identifiers

- CVE-2026-47768
- GHSA-9pg3-25fq-p6cc
- GO-2026-5294

## Timeline

- 2026-05-21: patched: Version 0.3.2 released
- 2026-05-21: advisory: GitHub Security Advisory GHSA-9pg3-25fq-p6cc published
- 2026-07-28: disclosed: CVE-2026-47768 published to NVD

## References

- [https://github.com/forgekeep/nebula-mesh/releases/tag/v0.3.2](https://github.com/forgekeep/nebula-mesh/releases/tag/v0.3.2)
- [https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-9pg3-25fq-p6cc](https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-9pg3-25fq-p6cc)

## Related threats

- [forgekeep nebula-mesh certificate revocation failure in agent](https://junglewise.ai/threats/cve-2026-61699-forgekeep-nebula-mesh-certificate-revocation-failure-in-agent)
- [forgekeep nebula-mesh insufficient session expiration in Web UI host creation](https://junglewise.ai/threats/cve-2026-55513-forgekeep-nebula-mesh-insufficient-session-expiration-in-web-ui)
- [forgekeep nebula-mesh resource exhaustion in OIDC login](https://junglewise.ai/threats/cve-2026-55512-forgekeep-nebula-mesh-resource-exhaustion-in-oidc-login)
- [forgekeep nebula-mesh cleartext storage of CA private key in memory](https://junglewise.ai/threats/cve-2026-53604-forgekeep-nebula-mesh-cleartext-storage-of-ca-private-key-in)
- [forgekeep nebula-mesh plaintext storage of operator session tokens](https://junglewise.ai/threats/cve-2026-53603-forgekeep-nebula-mesh-plaintext-storage-of-operator-session)