CVE-2026-47722

Name of the Vulnerable Software and Affected Versions nebula-mesh versions prior to 0.3.2

Description Host advanced overrides allow YAML injection into the agent config.yml. The issue occurs because the ListenHost and TunDevice fields are interpolated raw into a text/template within internal/configgen/generator.go and are accepted in internal/web/advanced.go without character or shape validation. An attacker with operator privileges can inject YAML keys into these fields, allowing a host to self-promote to a lighthouse or relay, thereby attracting mesh traffic or gaining unauthorized privileges within a tenant. This risk is amplified if combined with authentication authorization flaws that allow mutating other tenants' host overrides.

Recommendations Update nebula-mesh to version 0.3.2 or later. As a temporary mitigation, restrict operator access to the host advanced overrides configuration to prevent the injection of malicious values into the ListenHost and TunDevice fields.