Executive brief
Nebula Mesh is a tool used to manage secure overlay networks. A security issue was found where the management interface ignores administrator settings for how long temporary setup tokens should last, instead making them valid for 24 hours. This gives an attacker a much longer window to use a stolen or leaked token to join the private network as a trusted device.
Technical details
The vulnerability is classified as Insufficient Session Expiration (CWE-613) within the nebula-mgmt Web UI. While the API path correctly utilizes a TTL resolver that respects server-wide and per-network 'enrollment_token_ttl' configurations, the 'POST /ui/hosts' endpoint in 'internal/web/handlers.go' hardcodes a 24-hour expiry ('now.Add(24 * time.Hour)'). An authenticated operator with host-creation privileges can exploit this to mint bearer enrollment tokens that persist longer than the organization's defined security policy. These tokens are used at the public '/api/v1/enroll' endpoint to receive signed Nebula certificates. The issue is resolved in version 0.5.0 by aligning the Web UI logic with the API's TTL resolution.
Affected products
- forgekeep nebula-mesh >= 0.3.0, < 0.5.0
Timeline
- 2026-06-13: disclosed: Initial report by sondt99
- 2026-07-14: advisory: GitHub Advisory published
- 2026-07-14: patched: Version 0.5.0 released