CVE-2026-63464
Description
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators (role user) can set allow_private: true on their own managed webhook subscription (POST/PATCH /api/v1/webhook-subscriptions). No admin check exists on this field. At delivery time, allow_private switches the dispatcher to an unguarded HTTP client, bypassing the private/loopback/link-local SSRF guard — letting a low-privilege operator make the server request internal addresses. This issue has been patched in version 0.7.2.
How to fix
- github.com/forgekeep/nebula-mesh0.7.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/forgekeep/nebula-meshGo | 0.6.0 ≤ v < 0.7.2 | 0.7.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.