CVE-2026-47724: nebula-mesh API Authorization Bypass Enables Cross-Tenant Takeover (CVSS 9.9)

Executive Summary

CVE-2026-47724 is a critical authorization bypass vulnerability in nebula-mesh (the self-hosted control plane for Slack's Nebula overlay network) with a CVSS score of 9.9 (Critical). Prior to version 0.3.4, the /api/v1/* route surface validates only that a bearer token is authentic — it does not enforce per-CA ownership or tenant scope at the API layer. Any holder of a valid operator API key can therefore access and manipulate hosts, firewall rules, network configurations, and mobile bundles belonging to other Certificate Authorities (tenants).

The vulnerability was fixed in nebula-mesh v0.3.4. All operators running earlier versions should upgrade immediately.

What Is nebula-mesh

nebula-mesh is an open-source, self-hosted management control plane and web UI for Slack Nebula, a scalable overlay networking tool. nebula-mesh allows operators to manage multiple Nebula nodes, Certificate Authorities (CAs), hosts, firewall rules, and mobile device bundles through a single REST API surface. It is commonly used in multi-tenant deployments where different operators manage separate Nebula CA environments.

Vulnerability Details

Root Cause

The vulnerability is rooted in an asymmetry between the Web UI layer and the API layer:

• Web UI (internal/web/cas.go): Correctly gates state-changing routes through loadAccessibleCA — enforcing that the authenticated operator can only access CAs they own.
• API layer (/api/v1/*): Validates only the bearer token's authenticity. Per-CA ownership enforcement is absent. The codebase itself documents this gap at internal/api/hosts.go:384:

// API trusts the bearer token for authorisation;
// per-CA ownership is enforced only in the Web layer.

CA-management endpoints in internal/api/cas.go have proper canAccessCA gates — but the host, network, firewall, and mobile-bundle endpoints in the API layer are unprotected against cross-tenant access.

Attack Scope

Any holder of a non-admin operator API key can:

In a multi-tenant deployment, this amounts to complete cross-tenant privilege escalation: one operator's key grants broad access to all other tenants' Nebula infrastructure.

CVSS Score Breakdown

Affected Versions

Immediate Remediation

1. Upgrade to nebula-mesh v0.3.4

# Pull the latest release
go install github.com/juev/nebula-mesh@v0.3.4
 
# Or build from source
git clone https://github.com/juev/nebula-mesh
cd nebula-mesh
git checkout v0.3.4
go build ./...

2. Rotate All Operator API Keys

After upgrading, treat all existing operator API keys as potentially compromised — particularly if the API surface was reachable from untrusted networks. Generate fresh keys for all operators through the nebula-mesh admin interface.

3. Network Isolation (Interim)

If immediate upgrade is not possible, restrict access to the /api/v1/* endpoints using network-level controls:

# nginx: restrict API to trusted management IPs
location /api/v1/ {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    proxy_pass http://nebula-mesh:8080;
}

Detection

Check your nebula-mesh access logs for cross-CA API requests from unexpected operator keys:

# Review API access logs for /api/v1/ requests
# Flag requests where the operator key doesn't match the CA's expected owner
grep "GET /api/v1/hosts" nebula-mesh.log | \
  awk '{print $1, $4}' | sort | uniq -c | sort -rn

Look specifically for:

• A single operator key accessing hosts or firewall rules across multiple different CA namespaces
• API requests to host or firewall endpoints during off-hours
• Bulk enumeration patterns (sequential host IDs, large result set fetches)

References

• NIST NVD — CVE-2026-47724
• GitHub Security Advisory — nebula-mesh
• GitLab Advisory Database — CVE-2026-47724
• Slack Nebula — Upstream Project

Related Reading

• CVE-2026-15981: WordPress SAML SSO Authentication Bypass
• Apache Struts Critical RCE via OGNL Injection Returns