# CVE-2026-49258: Nebula Mesh authorization bypass in web UI host management

Source: https://junglewise.ai/threats/cve-2026-49258-nebula-mesh-authorization-bypass-in-web-ui-host-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-49258 · Severity: high · CVSS 8.8 · Published 2026-07-28

Nebula Mesh is a management tool for Slack Nebula VPNs, allowing administrators to control secure network connections. A security flaw in the web interface allows any registered user to view, block, or delete network resources belonging to other users. This could lead to unauthorized access to sensitive network configuration data or a complete disruption of VPN services for other customers or departments.

Technologies: [Forgekeep Nebula-Mesh](https://junglewise.ai/threats/technologies/nebula-mesh), [github.com/juev/nebula-mesh (Go)](https://junglewise.ai/threats/technologies/github-com-juev-nebula-mesh). Vendors: [Forgekeep](https://junglewise.ai/threats/vendors/forgekeep), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-49258 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49258 being exploited in the wild.

**How severe is CVE-2026-49258?** High severity, with a CVSS score of 8.8, published 28 July 2026.

**Which products and versions are affected?** Forgekeep Nebula-Mesh <= 0.3.4, <= 0.3.5; github.com/juev/nebula-mesh (Go) <= 0.3.4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=0.3.4.

**Is there a fix for CVE-2026-49258?** A patch was published on 2026-05-25: Fix merged in pull request 161 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49258 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-49258?** Check whether you run Forgekeep Nebula-Mesh or github.com/juev/nebula-mesh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Nebula Mesh fails to implement per-operator Certificate Authority (CA) scoping within its web UI handlers (/ui/*), a vulnerability class previously addressed only in the JSON API. The flaw stems from missing authorization checks in several handlers, including handleHostDetail, handleHostBlock, handleHostDelete, and others, which allow an attacker to perform Insecure Direct Object Reference (IDOR) attacks by manipulating resource IDs. An authenticated attacker with low privileges (such as a self-registered user) can read host names, public IPs, and certificate details, or perform mutation actions like blocking or deleting hosts belonging to other tenants. This issue is tracked as a regression/omission from a previous fix (GHSA-598g-h2vc-h5vg) and is resolved in version 0.3.6 by unifying ownership checks under the loadAccessibleHost helper.

## Affected products

- forgekeep Nebula Mesh <= 0.3.5

## Identifiers

- CVE-2026-49258
- GHSA-c6v2-3ffm-vcmc
- GO-2026-5816

## Timeline

- 2026-05-25: patched: Fix merged in pull request 161
- 2026-07-28: disclosed: CVE-2026-49258 published

## References

- [https://github.com/forgekeep/nebula-mesh/pull/161](https://github.com/forgekeep/nebula-mesh/pull/161)
- [https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-c6v2-3ffm-vcmc](https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-c6v2-3ffm-vcmc)

## Related threats

- [forgekeep nebula-mesh certificate revocation failure in agent](https://junglewise.ai/threats/cve-2026-61699-forgekeep-nebula-mesh-certificate-revocation-failure-in-agent)
- [forgekeep nebula-mesh insufficient session expiration in Web UI host creation](https://junglewise.ai/threats/cve-2026-55513-forgekeep-nebula-mesh-insufficient-session-expiration-in-web-ui)
- [forgekeep nebula-mesh resource exhaustion in OIDC login](https://junglewise.ai/threats/cve-2026-55512-forgekeep-nebula-mesh-resource-exhaustion-in-oidc-login)
- [forgekeep nebula-mesh cleartext storage of CA private key in memory](https://junglewise.ai/threats/cve-2026-53604-forgekeep-nebula-mesh-cleartext-storage-of-ca-private-key-in)
- [forgekeep nebula-mesh plaintext storage of operator session tokens](https://junglewise.ai/threats/cve-2026-53603-forgekeep-nebula-mesh-plaintext-storage-of-operator-session)