{"id":"CVE-2026-55513","title":"nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN","summary":"nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path ignores both the server-wide enrollment_token_ttl security setting and per-networ…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cwe":["CWE-613"],"vendor":"forgekeep","product":"nebula-mesh","affected":["nebula-mesh >= 0.3.0, < 0.5.0"],"patched":["github.com/forgekeep/nebula-mesh 0.5.0"],"published":"2026-09-04","updated":"2026-09-08","sourceUpdated":"2026-09-08T21:05:26.920","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55513","references":[{"url":"https://github.com/forgekeep/nebula-mesh/commit/514006029e09f1991122b86a80e7b25970bcfa98","label":"security-advisories@github.com"},{"url":"https://github.com/forgekeep/nebula-mesh/releases/tag/v0.5.0","label":"security-advisories@github.com"},{"url":"https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-g4x6-jcvr-9m3g","label":"security-advisories@github.com"},{"url":"https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-g4x6-jcvr-9m3g","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-g4x6-jcvr-9m3g"}],"tags":["nvd","cve.org","exploit-available","ghsa","go"],"epss":0.0032,"epssPercentile":0.2224,"aliases":["GHSA-g4x6-jcvr-9m3g"],"ecosystem":"go","exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-08T17:31:11.061279Z"},"ingestedAt":"2026-07-14T20:39:11.150Z","slug":"CVE-2026-55513","body":"## Overview\n\nnebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path ignores both the server-wide enrollment_token_ttl security setting and per-network network_config.enrollment_token_ttl overrides. API host creation and token-regeneration paths use the configured TTL resolver, but POST /ui/hosts hardcodes now.Add(24 * time.Hour) for newly minted agent enrollment tokens. In deployments that intentionally reduce enrollment-token lifetime, any authenticated operator who can create a host through the Web UI can still mint a bearer enrollment token valid for about 24 hours. This issue has been patched in version 0.5.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-55513)\n\nAffected packages:\n\n- `github.com/forgekeep/nebula-mesh >= 0.3.0, < 0.5.0`\n\nPatched in:\n\n- `github.com/forgekeep/nebula-mesh 0.5.0`\n\nSource: https://github.com/advisories/GHSA-g4x6-jcvr-9m3g","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":29.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":8192,"id":"CVE-2026-55513","ts":1788919974900,"field":"exploit_available","old":"false","new":"true"},{"seq":8001,"id":"CVE-2026-55513","ts":1788919276475,"field":"exploit_available","old":"true","new":"false"},{"seq":7810,"id":"CVE-2026-55513","ts":1788916335188,"field":"exploit_available","old":"false","new":"true"},{"seq":7619,"id":"CVE-2026-55513","ts":1788915292671,"field":"exploit_available","old":"true","new":"false"},{"seq":7428,"id":"CVE-2026-55513","ts":1788912696904,"field":"exploit_available","old":"false","new":"true"},{"seq":7237,"id":"CVE-2026-55513","ts":1788911324973,"field":"exploit_available","old":"true","new":"false"},{"seq":7043,"id":"CVE-2026-55513","ts":1788909062471,"field":"exploit_available","old":"false","new":"true"},{"seq":6855,"id":"CVE-2026-55513","ts":1788907386685,"field":"exploit_available","old":"true","new":"false"},{"seq":6657,"id":"CVE-2026-55513","ts":1788905429594,"field":"exploit_available","old":"false","new":"true"},{"seq":6475,"id":"CVE-2026-55513","ts":1788903455635,"field":"exploit_available","old":"true","new":"false"},{"seq":6270,"id":"CVE-2026-55513","ts":1788901798098,"field":"exploit_available","old":"false","new":"true"},{"seq":6100,"id":"CVE-2026-55513","ts":1788899558815,"field":"exploit_available","old":"true","new":"false"},{"seq":5911,"id":"CVE-2026-55513","ts":1788898149891,"field":"exploit_available","old":"false","new":"true"},{"seq":5800,"id":"CVE-2026-55513","ts":1788895709464,"field":"exploit_available","old":"true","new":"false"},{"seq":5672,"id":"CVE-2026-55513","ts":1788894523694,"field":"exploit_available","old":"false","new":"true"},{"seq":5630,"id":"CVE-2026-55513","ts":1788891869885,"field":"exploit_available","old":"true","new":"false"},{"seq":5609,"id":"CVE-2026-55513","ts":1788890892825,"field":"exploit_available","old":"false","new":"true"}]}