# CVE-2026-63464: nebula-mesh missing authorization in webhook subscriptions

Source: https://junglewise.ai/threats/cve-2026-63464-nebula-mesh-missing-authorization-in-webhook-subscriptions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-63464 · Severity: high · CVSS 7.7 · Published 2026-09-04

nebula-mesh is a self-hosted control plane for managing Slack's Nebula mesh VPN across networks. Non-admin operators could change webhook settings to bypass security controls that prevent server requests to internal network addresses, potentially allowing an attacker to access sensitive internal systems and data.

Technologies: [github.com/forgekeep/nebula-mesh (Go)](https://junglewise.ai/threats/technologies/github-com-forgekeep-nebula-mesh). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-63464 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63464 being exploited in the wild.

**How severe is CVE-2026-63464?** High severity, with a CVSS score of 7.7, published 4 September 2026.

**Which products and versions are affected?** github.com/forgekeep/nebula-mesh (Go) SEMVER:introduced=0.6.0,fixed=0.7.2.

**Is there a fix for CVE-2026-63464?** Yes. github.com/forgekeep/nebula-mesh (Go): upgrade to 0.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63464 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-63464?** Check whether you run github.com/forgekeep/nebula-mesh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/forgekeep/nebula-mesh (Go): upgrade to 0.7.2 or later

  ```sh
  go get github.com/forgekeep/nebula-mesh@v0.7.2
  ```


## Technical details

This is a missing authorization vulnerability in the nebula-mesh webhook subscription API endpoints (POST/PATCH /api/v1/webhook-subscriptions). Non-admin operators (role "user") could set the allow_private field to true, which switches the HTTP dispatcher to an unguarded client and bypasses SSRF protections (private/loopback/link-local address guards). An authenticated low-privilege operator can exploit this to make server-side requests to internal addresses, potentially discovering services via a reachability oracle (last_status/last_error fields). The fix, applied in version 0.7.2, adds admin-only authorization checks (isActiveAdmin) to both create and update handlers, consistent with other tenant-impacting operations.

## Affected products

- Slack nebula-mesh 0.6.0 to before 0.7.2

## Identifiers

- CVE-2026-63464
- GHSA-7rx3-5wx3-5v76
- GO-2026-5985

## Timeline

- 2026-09-04: disclosed
- 2026-07-01: patched: Fix released in version 0.7.2

## References

- [https://github.com/forgekeep/nebula-mesh/commit/f3c54530e388dd21763e548923426e60a8e93ff0](https://github.com/forgekeep/nebula-mesh/commit/f3c54530e388dd21763e548923426e60a8e93ff0)
- [https://github.com/forgekeep/nebula-mesh/releases/tag/v0.7.2](https://github.com/forgekeep/nebula-mesh/releases/tag/v0.7.2)

## Related threats

- [forgekeep nebula-mesh certificate revocation failure in agent](https://junglewise.ai/threats/cve-2026-61699-forgekeep-nebula-mesh-certificate-revocation-failure-in-agent)
- [forgekeep nebula-mesh insufficient session expiration in Web UI host creation](https://junglewise.ai/threats/cve-2026-55513-forgekeep-nebula-mesh-insufficient-session-expiration-in-web-ui)
- [forgekeep nebula-mesh resource exhaustion in OIDC login](https://junglewise.ai/threats/cve-2026-55512-forgekeep-nebula-mesh-resource-exhaustion-in-oidc-login)
- [forgekeep nebula-mesh cleartext storage of CA private key in memory](https://junglewise.ai/threats/cve-2026-53604-forgekeep-nebula-mesh-cleartext-storage-of-ca-private-key-in)
- [forgekeep nebula-mesh plaintext storage of operator session tokens](https://junglewise.ai/threats/cve-2026-53603-forgekeep-nebula-mesh-plaintext-storage-of-operator-session)