Is CVE-2026-63464 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63464 being exploited in the wild.

How severe is CVE-2026-63464?

High severity, with a CVSS score of 7.7, published 4 September 2026.

Which products and versions are affected?

github.com/forgekeep/nebula-mesh (Go) SEMVER:introduced=0.6.0,fixed=0.7.2.

Is there a fix for CVE-2026-63464?

Yes. github.com/forgekeep/nebula-mesh (Go): upgrade to 0.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63464 attacked?

It is attacked over the network.

Am I affected by CVE-2026-63464?

Check whether you run github.com/forgekeep/nebula-mesh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63464: nebula-mesh missing authorization in webhook subscriptions

CVE-2026-63464 · Severity: high · CVSS 7.7 · Published 2026-09-04

nebula-mesh is a self-hosted control plane for managing Slack's Nebula mesh VPN across networks. Non-admin operators could change webhook settings to bypass security controls that prevent server requests to internal network addresses, potentially allowing an attacker to access sensitive internal systems and data.

Technologies: github.com/forgekeep/nebula-mesh (Go). Vendors: Go.

Quick answers

Is CVE-2026-63464 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63464 being exploited in the wild.
How severe is CVE-2026-63464?: High severity, with a CVSS score of 7.7, published 4 September 2026.
Which products and versions are affected?: github.com/forgekeep/nebula-mesh (Go) SEMVER:introduced=0.6.0,fixed=0.7.2.
Is there a fix for CVE-2026-63464?: Yes. github.com/forgekeep/nebula-mesh (Go): upgrade to 0.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63464 attacked?: It is attacked over the network.
Am I affected by CVE-2026-63464?: Check whether you run github.com/forgekeep/nebula-mesh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/forgekeep/nebula-mesh (Go): upgrade to 0.7.2 or later
```
go get github.com/forgekeep/nebula-mesh@v0.7.2
```

Technical details

This is a missing authorization vulnerability in the nebula-mesh webhook subscription API endpoints (POST/PATCH /api/v1/webhook-subscriptions). Non-admin operators (role "user") could set the allow_private field to true, which switches the HTTP dispatcher to an unguarded client and bypasses SSRF protections (private/loopback/link-local address guards). An authenticated low-privilege operator can exploit this to make server-side requests to internal addresses, potentially discovering services via a reachability oracle (last_status/last_error fields). The fix, applied in version 0.7.2, adds admin-only authorization checks (isActiveAdmin) to both create and update handlers, consistent with other tenant-impacting operations.

Affected products

Slack nebula-mesh 0.6.0 to before 0.7.2

Identifiers

CVE-2026-63464
GHSA-7rx3-5wx3-5v76
GO-2026-5985

Timeline

2026-09-04: disclosed
2026-07-01: patched: Fix released in version 0.7.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.