# CVE-2026-55513: forgekeep nebula-mesh insufficient session expiration in Web UI host creation

Source: https://junglewise.ai/threats/cve-2026-55513-forgekeep-nebula-mesh-insufficient-session-expiration-in-web-ui  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-55513 · Severity: medium · CVSS 5.4 · Published 2026-09-04

Nebula Mesh is a tool used to manage secure overlay networks. A security issue was found where the management interface ignores administrator settings for how long temporary setup tokens should last, instead making them valid for 24 hours. This gives an attacker a much longer window to use a stolen or leaked token to join the private network as a trusted device.

Technologies: [Forgekeep Nebula-Mesh](https://junglewise.ai/threats/technologies/nebula-mesh), [github.com/forgekeep/nebula-mesh (Go)](https://junglewise.ai/threats/technologies/github-com-forgekeep-nebula-mesh), [github.com/juev/nebula-mesh (Go)](https://junglewise.ai/threats/technologies/github-com-juev-nebula-mesh). Vendors: [Forgekeep](https://junglewise.ai/threats/vendors/forgekeep), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-55513 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55513 being exploited in the wild.

**How severe is CVE-2026-55513?** Medium severity, with a CVSS score of 5.4, published 4 September 2026.

**Which products and versions are affected?** Forgekeep Nebula-Mesh >= 0.3.0, < 0.5.0; github.com/forgekeep/nebula-mesh (Go) >= 0.3.0, < 0.5.0, SEMVER:introduced=0.3.0,fixed=0.5.0, SEMVER:introduced=0.4.0,fixed=0.5.0; github.com/juev/nebula-mesh (Go) SEMVER:introduced=0.3.0.

**Is there a fix for CVE-2026-55513?** Yes. github.com/forgekeep/nebula-mesh (Go): upgrade to 0.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55513 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-55513?** Check whether you run Forgekeep Nebula-Mesh, github.com/forgekeep/nebula-mesh (Go) or github.com/juev/nebula-mesh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/forgekeep/nebula-mesh (Go): upgrade to 0.5.0 or later

  ```sh
  go get github.com/forgekeep/nebula-mesh@v0.5.0
  ```


## Technical details

The vulnerability is classified as Insufficient Session Expiration (CWE-613) within the nebula-mgmt Web UI. While the API path correctly utilizes a TTL resolver that respects server-wide and per-network 'enrollment_token_ttl' configurations, the 'POST /ui/hosts' endpoint in 'internal/web/handlers.go' hardcodes a 24-hour expiry ('now.Add(24 * time.Hour)'). An authenticated operator with host-creation privileges can exploit this to mint bearer enrollment tokens that persist longer than the organization's defined security policy. These tokens are used at the public '/api/v1/enroll' endpoint to receive signed Nebula certificates. The issue is resolved in version 0.5.0 by aligning the Web UI logic with the API's TTL resolution.

## Affected products

- forgekeep nebula-mesh >= 0.3.0, < 0.5.0

## Identifiers

- CVE-2026-55513
- GHSA-g4x6-jcvr-9m3g
- GO-2026-5987

## Timeline

- 2026-06-13: disclosed: Initial report by sondt99
- 2026-07-14: advisory: GitHub Advisory published
- 2026-07-14: patched: Version 0.5.0 released

## References

- [https://api.github.com/users/sondt99](https://api.github.com/users/sondt99)
- [https://github.com/sondt99](https://github.com/sondt99)
- [https://api.github.com/users/sondt99/gists%7B/gist_id%7D](https://api.github.com/users/sondt99/gists%7B/gist_id%7D)
- [https://api.github.com/users/sondt99/repos](https://api.github.com/users/sondt99/repos)
- [https://avatars.githubusercontent.com/u/87920408?v=4](https://avatars.githubusercontent.com/u/87920408?v=4)
- [https://api.github.com/users/sondt99/events%7B/privacy%7D](https://api.github.com/users/sondt99/events%7B/privacy%7D)

## Related threats

- [nebula-mesh missing authorization in webhook subscriptions](https://junglewise.ai/threats/cve-2026-63464-nebula-mesh-missing-authorization-in-webhook-subscriptions)
- [forgekeep nebula-mesh certificate revocation failure in agent](https://junglewise.ai/threats/cve-2026-61699-forgekeep-nebula-mesh-certificate-revocation-failure-in-agent)
- [forgekeep nebula-mesh resource exhaustion in OIDC login](https://junglewise.ai/threats/cve-2026-55512-forgekeep-nebula-mesh-resource-exhaustion-in-oidc-login)
- [forgekeep nebula-mesh cleartext storage of CA private key in memory](https://junglewise.ai/threats/cve-2026-53604-forgekeep-nebula-mesh-cleartext-storage-of-ca-private-key-in)
- [forgekeep nebula-mesh plaintext storage of operator session tokens](https://junglewise.ai/threats/cve-2026-53603-forgekeep-nebula-mesh-plaintext-storage-of-operator-session)