GO-2026-5985None▾ Sunlit

Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private` in github.com/forgekeep/nebula-mesh

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jul 17, 2026

Updated

Jul 21, 2026

CVSS

—

Vendor

forgekeep

Product

github.com/forgekeep/nebula-mesh

CWE

—

Depth score

3 · Minimal

EPSS

—

Platforms

—

Source

OSV

Vector

—

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

2 events · 4 days

Jul 17, 2026Published
Disclosed via OSV
Jul 21, 2026Record revised
Last analysed / modified upstream

forgekeep #osv #go

Affected

github.com/forgekeep/nebula-mesh >= 0.6.0, < 0.7.2

Patched in

github.com/forgekeep/nebula-mesh 0.7.2

Full technical detail▾

Overview

Nebula-mesh allows non-admin operators to disable webhook SSRF protection via allow_private in github.com/forgekeep/nebula-mesh

Affected packages

github.com/forgekeep/nebula-mesh >= 0.6.0, < 0.7.2

Remediation

Upgrade to a patched release:

github.com/forgekeep/nebula-mesh 0.7.2

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#osv#go

← Back to feed