Product by Juev
Nebula-mesh
9 known vulnerabilities in Nebula-mesh (Juev), 0 of them actively exploited (CISA KEV).
Key figures
9
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-47724 | nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation | 9.9 | |
| High | CVE-2026-49258 | Juev Nebula-mesh: Authorization Bypass Through User-Controlled Key | 8.8 | |
| High | CVE-2026-47722 | nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml | — | |
| High | CVE-2026-47723 | nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.) | — | |
| Medium | CVE-2026-48025 | nebula-mesh: Decrypted CA private key persists in heap after signing | — | |
| High | CVE-2026-47726 | nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator | — | |
| Medium | CVE-2026-47725 | nebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpoints | — | |
| Medium | CVE-2026-47768 | nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs) | 5.5 | |
| Medium | CVE-2026-48058 | nebula-mesh: Session and OIDC state cookies lack the Secure attribute | — |