Is CVE-2026-49258 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49258 being exploited in the wild.

How severe is CVE-2026-49258?

High severity, with a CVSS score of 8.8, published 28 July 2026.

Which products and versions are affected?

Forgekeep Nebula-Mesh <= 0.3.4, <= 0.3.5; github.com/juev/nebula-mesh (Go) <= 0.3.4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=0.3.4.

Is there a fix for CVE-2026-49258?

A patch was published on 2026-05-25: Fix merged in pull request 161 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49258 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-49258?

Check whether you run Forgekeep Nebula-Mesh or github.com/juev/nebula-mesh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49258: Nebula Mesh authorization bypass in web UI host management

Q: Is there a fix for CVE-2026-49258?

A patch was published on 2026-05-25: Fix merged in pull request 161 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-49258 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-49258?

Check whether you run Forgekeep Nebula-Mesh or github.com/juev/nebula-mesh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49258 · Severity: high · CVSS 8.8 · Published 2026-07-28

Nebula Mesh is a management tool for Slack Nebula VPNs, allowing administrators to control secure network connections. A security flaw in the web interface allows any registered user to view, block, or delete network resources belonging to other users. This could lead to unauthorized access to sensitive network configuration data or a complete disruption of VPN services for other customers or departments.

Technologies: Forgekeep Nebula-Mesh, github.com/juev/nebula-mesh (Go). Vendors: Forgekeep, Go.

Quick answers

Is CVE-2026-49258 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49258 being exploited in the wild.
How severe is CVE-2026-49258?: High severity, with a CVSS score of 8.8, published 28 July 2026.
Which products and versions are affected?: Forgekeep Nebula-Mesh <= 0.3.4, <= 0.3.5; github.com/juev/nebula-mesh (Go) <= 0.3.4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=0.3.4.
Is there a fix for CVE-2026-49258?: A patch was published on 2026-05-25: Fix merged in pull request 161 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49258 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-49258?: Check whether you run Forgekeep Nebula-Mesh or github.com/juev/nebula-mesh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Nebula Mesh fails to implement per-operator Certificate Authority (CA) scoping within its web UI handlers (/ui/*), a vulnerability class previously addressed only in the JSON API. The flaw stems from missing authorization checks in several handlers, including handleHostDetail, handleHostBlock, handleHostDelete, and others, which allow an attacker to perform Insecure Direct Object Reference (IDOR) attacks by manipulating resource IDs. An authenticated attacker with low privileges (such as a self-registered user) can read host names, public IPs, and certificate details, or perform mutation actions like blocking or deleting hosts belonging to other tenants. This issue is tracked as a regression/omission from a previous fix (GHSA-598g-h2vc-h5vg) and is resolved in version 0.3.6 by unifying ownership checks under the loadAccessibleHost helper.

Affected products

forgekeep Nebula Mesh <= 0.3.5

Identifiers

CVE-2026-49258
GHSA-c6v2-3ffm-vcmc
GO-2026-5816

Timeline

2026-05-25: patched: Fix merged in pull request 161
2026-07-28: disclosed: CVE-2026-49258 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.