# forgekeep nebula-mesh sensitive information leak via missing Cache-Control headers

Source: https://junglewise.ai/threats/forgekeep-nebula-mesh-sensitive-information-leak-via-missing-cache-abc490e2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-12. Updated: 2026-06-12  
License: CC BY 4.0 with a link back

Severity: low · CVSS 2.3 · Published 2026-06-12

A vulnerability in the nebula-mesh API could allow sensitive security keys to be stored in web caches or browser history. This occurs because the system fails to tell web browsers and intermediate servers not to save the response containing private X25519 keys. If an attacker gains access to these cached files, they could potentially compromise the encrypted communications of the affected hosts.

Technologies: [Forgekeep Nebula-Mesh](https://junglewise.ai/threats/technologies/nebula-mesh), [github.com/juev/nebula-mesh (Go)](https://junglewise.ai/threats/technologies/github-com-juev-nebula-mesh). Vendors: [Forgekeep](https://junglewise.ai/threats/vendors/forgekeep), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 2.3, published 12 June 2026.

**Which products and versions are affected?** Forgekeep Nebula-Mesh <= 0.3.1; github.com/juev/nebula-mesh (Go) <= 0.3.1.

**Is there a fix for This vulnerability?** A patch was published on 2026-06-12. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Forgekeep Nebula-Mesh or github.com/juev/nebula-mesh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The `POST /api/v1/hosts/{id}/mobile-bundle` endpoint in `internal/api/mobile_bundle.go` fails to set `Cache-Control: no-store` and related security headers. Because this endpoint returns a freshly generated X25519 private key in a YAML bundle, the absence of these headers allows the sensitive response to be stored by transparent proxies, CDNs, or local browser disk caches. An attacker with access to these caches could retrieve the private keys. This issue was previously fixed in the Web-UI component but was missed in the API implementation. The vulnerability is addressed in version 0.3.2 by adding `Cache-Control: no-store`, `Pragma: no-cache`, `Expires: 0`, and `X-Content-Type-Options: nosniff` headers.

## Affected products

- forgekeep nebula-mesh <= 0.3.1

## Timeline

- 2026-05-21: disclosed
- 2026-06-12: advisory: GHSA-6vgg-xhvh-38ff published
- 2026-06-12: patched

## References

- [https://api.github.com/users/ak2k](https://api.github.com/users/ak2k)
- [https://github.com/ak2k](https://github.com/ak2k)
- [https://api.github.com/users/ak2k/gists%7B/gist_id%7D](https://api.github.com/users/ak2k/gists%7B/gist_id%7D)
- [https://api.github.com/users/ak2k/repos](https://api.github.com/users/ak2k/repos)
- [https://avatars.githubusercontent.com/u/19240940?v=4](https://avatars.githubusercontent.com/u/19240940?v=4)
- [https://api.github.com/users/ak2k/events%7B/privacy%7D](https://api.github.com/users/ak2k/events%7B/privacy%7D)

## Related threats

- [forgekeep nebula-mesh certificate revocation failure in agent](https://junglewise.ai/threats/cve-2026-61699-forgekeep-nebula-mesh-certificate-revocation-failure-in-agent)
- [forgekeep nebula-mesh insufficient session expiration in Web UI host creation](https://junglewise.ai/threats/cve-2026-55513-forgekeep-nebula-mesh-insufficient-session-expiration-in-web-ui)
- [forgekeep nebula-mesh resource exhaustion in OIDC login](https://junglewise.ai/threats/cve-2026-55512-forgekeep-nebula-mesh-resource-exhaustion-in-oidc-login)
- [forgekeep nebula-mesh cleartext storage of CA private key in memory](https://junglewise.ai/threats/cve-2026-53604-forgekeep-nebula-mesh-cleartext-storage-of-ca-private-key-in)
- [forgekeep nebula-mesh plaintext storage of operator session tokens](https://junglewise.ai/threats/cve-2026-53603-forgekeep-nebula-mesh-plaintext-storage-of-operator-session)