---
id: CVE-2026-55512
title: nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN
summary: >-
  nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From
  version 0.2.0 to before version 0.5.0, when OIDC is enabled, GET
  /ui/oidc/login is reachable without authentication and is registered outside
  the Web UI rate-limi…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-400
vendor: forgekeep
product: nebula-mesh
affected:
  - 'nebula-mesh >= 0.2.0, < 0.5.0'
patched:
  - github.com/forgekeep/nebula-mesh 0.5.0
published: '2026-09-04'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T16:17:03.353'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55512'
references:
  - url: >-
      https://github.com/forgekeep/nebula-mesh/commit/bc387086cc0e4b9c1654468b7391af19cacfe367
    label: security-advisories@github.com
  - url: 'https://github.com/forgekeep/nebula-mesh/releases/tag/v0.5.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-m3cx-mwpg-32jg
    label: security-advisories@github.com
  - url: >-
      https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-m3cx-mwpg-32jg
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-m3cx-mwpg-32jg'
tags:
  - nvd
  - cve.org
  - exploit-available
  - ghsa
  - go
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-09T15:55:55.358795Z'
epss: 0.00597
epssPercentile: 0.46221
aliases:
  - GHSA-m3cx-mwpg-32jg
ecosystem: go
ingestedAt: '2026-07-14T20:39:11.169Z'
---

## Overview

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.2.0 to before version 0.5.0, when OIDC is enabled, GET /ui/oidc/login is reachable without authentication and is registered outside the Web UI rate-limited auth routes. Every request creates a fresh random OIDC state value and stores it in an in-memory map for 10m. Expired states are swept lazily, but there is no rate limit or maximum live-state cap on the allocation path. An unauthenticated remote client can therefore grow OIDC.states for the full state TTL, bounded by request throughput rather than by configured auth rate limits. This issue has been patched in version 0.5.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-55512)

Affected packages:

- `github.com/forgekeep/nebula-mesh >= 0.2.0, < 0.5.0`

Patched in:

- `github.com/forgekeep/nebula-mesh 0.5.0`

Source: https://github.com/advisories/GHSA-m3cx-mwpg-32jg