Is CVE-2026-55513 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55513 being exploited in the wild.

How severe is CVE-2026-55513?

Medium severity, with a CVSS score of 5.4, published 4 September 2026.

Which products and versions are affected?

Forgekeep Nebula-Mesh >= 0.3.0, = 0.3.0, < 0.5.0, SEMVER:introduced=0.3.0,fixed=0.5.0, SEMVER:introduced=0.4.0,fixed=0.5.0; github.com/juev/nebula-mesh (Go) SEMVER:introduced=0.3.0.

Is there a fix for CVE-2026-55513?

Yes. github.com/forgekeep/nebula-mesh (Go): upgrade to 0.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55513 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-55513?

Check whether you run Forgekeep Nebula-Mesh, github.com/forgekeep/nebula-mesh (Go) or github.com/juev/nebula-mesh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55513: forgekeep nebula-mesh insufficient session expiration in Web UI host creation

Q: Is there a fix for CVE-2026-55513?

Yes. github.com/forgekeep/nebula-mesh (Go): upgrade to 0.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55513 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-55513?

Check whether you run Forgekeep Nebula-Mesh, github.com/forgekeep/nebula-mesh (Go) or github.com/juev/nebula-mesh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55513 · Severity: medium · CVSS 5.4 · Published 2026-09-04

Nebula Mesh is a tool used to manage secure overlay networks. A security issue was found where the management interface ignores administrator settings for how long temporary setup tokens should last, instead making them valid for 24 hours. This gives an attacker a much longer window to use a stolen or leaked token to join the private network as a trusted device.

Technologies: Forgekeep Nebula-Mesh, github.com/forgekeep/nebula-mesh (Go), github.com/juev/nebula-mesh (Go). Vendors: Forgekeep, Go.

Quick answers

Is CVE-2026-55513 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55513 being exploited in the wild.
How severe is CVE-2026-55513?: Medium severity, with a CVSS score of 5.4, published 4 September 2026.
Which products and versions are affected?: Forgekeep Nebula-Mesh >= 0.3.0, < 0.5.0; github.com/forgekeep/nebula-mesh (Go) >= 0.3.0, < 0.5.0, SEMVER:introduced=0.3.0,fixed=0.5.0, SEMVER:introduced=0.4.0,fixed=0.5.0; github.com/juev/nebula-mesh (Go) SEMVER:introduced=0.3.0.
Is there a fix for CVE-2026-55513?: Yes. github.com/forgekeep/nebula-mesh (Go): upgrade to 0.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55513 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-55513?: Check whether you run Forgekeep Nebula-Mesh, github.com/forgekeep/nebula-mesh (Go) or github.com/juev/nebula-mesh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/forgekeep/nebula-mesh (Go): upgrade to 0.5.0 or later
```
go get github.com/forgekeep/nebula-mesh@v0.5.0
```

Technical details

The vulnerability is classified as Insufficient Session Expiration (CWE-613) within the nebula-mgmt Web UI. While the API path correctly utilizes a TTL resolver that respects server-wide and per-network 'enrollment_token_ttl' configurations, the 'POST /ui/hosts' endpoint in 'internal/web/handlers.go' hardcodes a 24-hour expiry ('now.Add(24 * time.Hour)'). An authenticated operator with host-creation privileges can exploit this to mint bearer enrollment tokens that persist longer than the organization's defined security policy. These tokens are used at the public '/api/v1/enroll' endpoint to receive signed Nebula certificates. The issue is resolved in version 0.5.0 by aligning the Web UI logic with the API's TTL resolution.

Affected products

forgekeep nebula-mesh >= 0.3.0, < 0.5.0

Identifiers

CVE-2026-55513
GHSA-g4x6-jcvr-9m3g
GO-2026-5987

Timeline

2026-06-13: disclosed: Initial report by sondt99
2026-07-14: advisory: GitHub Advisory published
2026-07-14: patched: Version 0.5.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.