Executive brief
nebula-mesh is a self-hosted control plane for managing Slack's Nebula mesh VPN across networks. Non-admin operators could change webhook settings to bypass security controls that prevent server requests to internal network addresses, potentially allowing an attacker to access sensitive internal systems and data.
Technical details
This is a missing authorization vulnerability in the nebula-mesh webhook subscription API endpoints (POST/PATCH /api/v1/webhook-subscriptions). Non-admin operators (role "user") could set the allow_private field to true, which switches the HTTP dispatcher to an unguarded client and bypasses SSRF protections (private/loopback/link-local address guards). An authenticated low-privilege operator can exploit this to make server-side requests to internal addresses, potentially discovering services via a reachability oracle (last_status/last_error fields). The fix, applied in version 0.7.2, adds admin-only authorization checks (isActiveAdmin) to both create and update handlers, consistent with other tenant-impacting operations.
Affected products
- Slack nebula-mesh 0.6.0 to before 0.7.2
Timeline
- 2026-09-04: disclosed
- 2026-07-01: patched: Fix released in version 0.7.2