# CVE-2026-48058: forgekeep nebula-mesh missing Secure attribute on sensitive cookies

Source: https://junglewise.ai/threats/cve-2026-48058-forgekeep-nebula-mesh-missing-secure-attribute-on-sensitive  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-48058 · Severity: medium · CVSS 4 · Published 2026-07-28

nebula-mesh is a management tool for Slack Nebula virtual private networks. A security flaw was identified where the system failed to properly protect session cookies, allowing them to be transmitted over unencrypted connections. If an administrator accidentally accesses the management interface via an insecure link or if the network is misconfigured, an attacker could intercept their session and take full control of the VPN management console.

Technologies: [Forgekeep Nebula-Mesh](https://junglewise.ai/threats/technologies/nebula-mesh), [github.com/juev/nebula-mesh (Go)](https://junglewise.ai/threats/technologies/github-com-juev-nebula-mesh). Vendors: [Forgekeep](https://junglewise.ai/threats/vendors/forgekeep), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-48058 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48058 being exploited in the wild.

**How severe is CVE-2026-48058?** Medium severity, with a CVSS score of 4, published 28 July 2026.

**Which products and versions are affected?** Forgekeep Nebula-Mesh < 0.3.2; github.com/juev/nebula-mesh (Go) < 0.3.2, SEMVER:introduced=0,fixed=0.3.2.

**Is there a fix for CVE-2026-48058?** Yes. github.com/juev/nebula-mesh (Go): upgrade to 0.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48058 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-48058?** Check whether you run Forgekeep Nebula-Mesh or github.com/juev/nebula-mesh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/juev/nebula-mesh (Go): upgrade to 0.3.2 or later

  ```sh
  go get github.com/juev/nebula-mesh@v0.3.2
  ```


## Technical details

The vulnerability exists in 'internal/web/session.go' and 'internal/web/oidc.go' where cookies are initialized with 'HttpOnly' and 'SameSite=Lax' attributes but lack the 'Secure' flag. This omission allows the browser to transmit sensitive session identifiers and OIDC state tokens over unencrypted HTTP. An attacker capable of observing network traffic (e.g., on a local network or due to a reverse proxy misconfiguration) can capture these cookies if a user makes a single plaintext request to the origin. This leads to session hijacking for the duration of the 24-hour session TTL or CSRF attacks against the OIDC callback. The issue is addressed in version 0.3.2 by introducing a 'cookie_secure' configuration option.

## Affected products

- forgekeep nebula-mesh < 0.3.2

## Identifiers

- CVE-2026-48058
- GHSA-rqfj-vv8r-xhqc
- GO-2026-5635

## Timeline

- 2026-05-20: advisory: GitHub Security Advisory GHSA-rqfj-vv8r-xhqc published
- 2026-05-21: patched: Version 0.3.2 released with fix
- 2026-07-28: disclosed: CVE-2026-48058 published to NVD

## References

- [https://github.com/forgekeep/nebula-mesh/commit/ffdd67dbf221d9a5855c39fbe11b49c245048d85](https://github.com/forgekeep/nebula-mesh/commit/ffdd67dbf221d9a5855c39fbe11b49c245048d85)
- [https://github.com/forgekeep/nebula-mesh/releases/tag/v0.3.2](https://github.com/forgekeep/nebula-mesh/releases/tag/v0.3.2)
- [https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-rqfj-vv8r-xhqc](https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-rqfj-vv8r-xhqc)

## Related threats

- [forgekeep nebula-mesh certificate revocation failure in agent](https://junglewise.ai/threats/cve-2026-61699-forgekeep-nebula-mesh-certificate-revocation-failure-in-agent)
- [forgekeep nebula-mesh insufficient session expiration in Web UI host creation](https://junglewise.ai/threats/cve-2026-55513-forgekeep-nebula-mesh-insufficient-session-expiration-in-web-ui)
- [forgekeep nebula-mesh resource exhaustion in OIDC login](https://junglewise.ai/threats/cve-2026-55512-forgekeep-nebula-mesh-resource-exhaustion-in-oidc-login)
- [forgekeep nebula-mesh cleartext storage of CA private key in memory](https://junglewise.ai/threats/cve-2026-53604-forgekeep-nebula-mesh-cleartext-storage-of-ca-private-key-in)
- [forgekeep nebula-mesh plaintext storage of operator session tokens](https://junglewise.ai/threats/cve-2026-53603-forgekeep-nebula-mesh-plaintext-storage-of-operator-session)