Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 5, published 22 June 2026.

Which products and versions are affected?

github.com/juev/nebula-mesh (Go) <= 0.3.1.

Is there a fix for This vulnerability?

A patch was published on 2026-06-22: Version 0.3.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network or with local access, in a software library.

Check whether you run github.com/juev/nebula-mesh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

juev nebula-mesh cleartext storage of enrollment tokens in SQLite

Q: Is there a fix for This vulnerability?

A patch was published on 2026-06-22: Version 0.3.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network or with local access, in a software library.

Q: Am I affected?

Check whether you run github.com/juev/nebula-mesh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: medium · CVSS 5 · Published 2026-06-22

Nebula Mesh, a tool for managing secure overlay networks, was found to store enrollment tokens in plain text within its database. If an attacker gains access to database backups or snapshots, they can steal these tokens to impersonate legitimate devices and join the private network. This could allow unauthorized access to sensitive internal systems and data.

Technologies: github.com/juev/nebula-mesh (Go). Vendors: Go.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 5, published 22 June 2026.
Which products and versions are affected?: github.com/juev/nebula-mesh (Go) <= 0.3.1.
Is there a fix for This vulnerability?: A patch was published on 2026-06-22: Version 0.3.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network or with local access, in a software library.
Am I affected?: Check whether you run github.com/juev/nebula-mesh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Nebula Mesh (github.com/juev/nebula-mesh) stores enrollment tokens as raw UUID strings in the 'enrollment_tokens.token' column of its SQLite database. This lacks defense-in-depth compared to other sensitive fields like API keys, which are SHA-256 hashed. An attacker with read access to the database (via backups, filesystem access, or SQL injection) can retrieve these single-use tokens. By consuming a token before the legitimate agent, an attacker can mint a certificate against their own keypair and assume the agent's identity within the Nebula mesh. The issue is addressed in version 0.3.2 by implementing SHA-256 hashing for tokens at rest.

Affected products

juev nebula-mesh <= 0.3.1

Timeline

2026-05-21: disclosed: Advisory created by researcher
2026-06-22: advisory: GitHub Advisory published
2026-06-22: patched: Version 0.3.2 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.