CVE-2026-53603: fallo de gravedad alta en forgekeep nebula-mesh
nebula-mesh: Operator session tokens stored in plaintext in the database
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.1epss 0.4%
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintext in the operator_sessions table (the token column is the PRIMARY KEY). The session token is a 32-byte random hex value sent directly in a cookie and valid for 24 hours. Anyone who can read the database (backup, snapshot, file copy, or SQL-level disclosure) obtains every active session token and can hijack operator sessions directly, with no further authentication. This issue has been patched in version 0.3.8.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
forgekeep · nebula-meshCVEs relacionadas — forgekeep nebula-mesh
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-55512MEDIUMnebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limitingEPSS 0.6%CVE-2026-63464HIGHNebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`EPSS 0.5%CVE-2026-61699HIGHnebula-mesh: Certificate revocation is never enforced at the meshEPSS 0.4%CVE-2026-55513MEDIUMnebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokensEPSS 0.3%CVE-2026-53602MEDIUMnebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificateEPSS 0.3%CVE-2026-53604HIGHnebula-mesh: CA private key not zeroized on web mobile-bundle error pathsEPSS 0.2%