Executive brief
nebula-mesh is a management tool for Slack Nebula virtual private networks. A security flaw was identified where the system failed to properly protect session cookies, allowing them to be transmitted over unencrypted connections. If an administrator accidentally accesses the management interface via an insecure link or if the network is misconfigured, an attacker could intercept their session and take full control of the VPN management console.
Technical details
The vulnerability exists in 'internal/web/session.go' and 'internal/web/oidc.go' where cookies are initialized with 'HttpOnly' and 'SameSite=Lax' attributes but lack the 'Secure' flag. This omission allows the browser to transmit sensitive session identifiers and OIDC state tokens over unencrypted HTTP. An attacker capable of observing network traffic (e.g., on a local network or due to a reverse proxy misconfiguration) can capture these cookies if a user makes a single plaintext request to the origin. This leads to session hijacking for the duration of the 24-hour session TTL or CSRF attacks against the OIDC callback. The issue is addressed in version 0.3.2 by introducing a 'cookie_secure' configuration option.
Affected products
- forgekeep nebula-mesh < 0.3.2
Timeline
- 2026-05-20: advisory: GitHub Security Advisory GHSA-rqfj-vv8r-xhqc published
- 2026-05-21: patched: Version 0.3.2 released with fix
- 2026-07-28: disclosed: CVE-2026-48058 published to NVD