forgekeep nebula-mesh sensitive information leak via missing Cache-Control headers

Severity: low · CVSS 2.3 · Published 2026-06-12

A vulnerability in the nebula-mesh API could allow sensitive security keys to be stored in web caches or browser history. This occurs because the system fails to tell web browsers and intermediate servers not to save the response containing private X25519 keys. If an attacker gains access to these cached files, they could potentially compromise the encrypted communications of the affected hosts.

Technologies: Forgekeep Nebula-Mesh, github.com/juev/nebula-mesh (Go). Vendors: Forgekeep, Go.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Low severity, with a CVSS score of 2.3, published 12 June 2026.
Which products and versions are affected?
Forgekeep Nebula-Mesh <= 0.3.1; github.com/juev/nebula-mesh (Go) <= 0.3.1.
Is there a fix for This vulnerability?
A patch was published on 2026-06-12. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run Forgekeep Nebula-Mesh or github.com/juev/nebula-mesh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The `POST /api/v1/hosts/{id}/mobile-bundle` endpoint in `internal/api/mobile_bundle.go` fails to set `Cache-Control: no-store` and related security headers. Because this endpoint returns a freshly generated X25519 private key in a YAML bundle, the absence of these headers allows the sensitive response to be stored by transparent proxies, CDNs, or local browser disk caches. An attacker with access to these caches could retrieve the private keys. This issue was previously fixed in the Web-UI component but was missed in the API implementation. The vulnerability is addressed in version 0.3.2 by adding `Cache-Control: no-store`, `Pragma: no-cache`, `Expires: 0`, and `X-Content-Type-Options: nosniff` headers.

Affected products

  • forgekeep nebula-mesh <= 0.3.1

Timeline

  • 2026-05-21: disclosed
  • 2026-06-12: advisory: GHSA-6vgg-xhvh-38ff published
  • 2026-06-12: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.