CVE-2026-47725

Name of the Vulnerable Software and Affected Versions nebula-mesh versions prior to 0.3.2

Description The web UI lacks Cross-Site Request Forgery (CSRF) protection on all /ui/* routes using POST, PUT, PATCH, or DELETE methods. The application processes requests immediately upon session cookie validation. While SameSite=Lax provides partial protection, it does not prevent top-level form-submit navigations from third-party pages, attacks from same-registrable-domain sources (such as sibling-subdomain XSS or subdomain takeover), or forced triggers of the GET /ui/logout route via image tags. This allows attackers to perform privileged actions, including signing CA certificates, minting API keys, rotating or deleting CAs, disabling operators, and modifying server settings.

Recommendations Update to version 0.3.2 or later. Implement a double-submit cookie mechanism using a 32-byte crypto/rand token in a non-HttpOnly csrf cookie, which must be echoed in the X-CSRF-Token header or a csrf form field and compared in constant time. Ensure the csrf cookie is rotated during every privilege transition, including Login, OIDC StartAuthenticatedSession, CompleteTwoFactor, and Logout. Change the /ui/logout route to use the POST method to prevent it from being triggered via <img> tags.