Executive brief
Nebula-mesh, a tool for managing secure overlay networks, contains a flaw that allows standard users to bypass security restrictions. By manipulating webhook settings, a non-administrative user can force the server to send requests to internal systems that should be private. This could allow an attacker to probe internal network services or potentially access sensitive cloud credentials, leading to unauthorized data exposure.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Nebula-mesh due to missing authorization checks in the webhook subscription API. Non-admin operators (role 'user') can set the 'allow_private' field to true when creating or updating subscriptions via '/api/v1/webhook-subscriptions'. When this flag is enabled, the dispatcher switches to an unguarded HTTP client that bypasses the standard private/loopback/link-local address guards. An authenticated attacker can use this to perform internal network scanning or interact with internal services. The vulnerability is patched in version 0.7.2.
Affected products
- forgekeep nebula-mesh >= 0.6.0, <= 0.7.1
Timeline
- 2026-07-01: disclosed: Vulnerability reported and verified by researcher.
- 2026-07-01: patched: Version 0.7.2 released.
- 2026-07-14: advisory: GitHub Advisory GHSA-7rx3-5wx3-5v76 published.