CVE-2026-63464: high-severity vulnerability in forgekeep nebula-mesh
Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.7epss 0.5%
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators (role user) can set allow_private: true on their own managed webhook subscription (POST/PATCH /api/v1/webhook-subscriptions). No admin check exists on this field. At delivery time, allow_private switches the dispatcher to an unguarded HTTP client, bypassing the private/loopback/link-local SSRF guard — letting a low-privilege operator make the server request internal addresses. This issue has been patched in version 0.7.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected products
forgekeep · nebula-meshRelated CVEs — forgekeep nebula-mesh
In the same product, most dangerous first.
CVE-2026-55512MEDIUMnebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limitingEPSS 0.6%CVE-2026-61699HIGHnebula-mesh: Certificate revocation is never enforced at the meshEPSS 0.4%CVE-2026-53603HIGHnebula-mesh: Operator session tokens stored in plaintext in the databaseEPSS 0.4%CVE-2026-55513MEDIUMnebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokensEPSS 0.3%CVE-2026-53602MEDIUMnebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificateEPSS 0.3%CVE-2026-53604HIGHnebula-mesh: CA private key not zeroized on web mobile-bundle error pathsEPSS 0.2%