CVE-2026-53603: falha de alta gravidade em forgekeep nebula-mesh
nebula-mesh: Operator session tokens stored in plaintext in the database
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.4%
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintext in the operator_sessions table (the token column is the PRIMARY KEY). The session token is a 32-byte random hex value sent directly in a cookie and valid for 24 hours. Anyone who can read the database (backup, snapshot, file copy, or SQL-level disclosure) obtains every active session token and can hijack operator sessions directly, with no further authentication. This issue has been patched in version 0.3.8.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
forgekeep · nebula-meshCVEs relacionadas — forgekeep nebula-mesh
No mesmo produto, das mais perigosas para as menos.
CVE-2026-55512MEDIUMnebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limitingEPSS 0.6%CVE-2026-63464HIGHNebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`EPSS 0.5%CVE-2026-61699HIGHnebula-mesh: Certificate revocation is never enforced at the meshEPSS 0.4%CVE-2026-55513MEDIUMnebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokensEPSS 0.3%CVE-2026-53602MEDIUMnebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificateEPSS 0.3%CVE-2026-53604HIGHnebula-mesh: CA private key not zeroized on web mobile-bundle error pathsEPSS 0.2%