CVE-2026-47726

Name of the Vulnerable Software and Affected Versions nebula-mesh versions prior to 0.3.1

Description The handleGetAuditLog function in internal/api/audit.go fails to perform an administrative privilege check. While the endpoint is protected by bearer authentication, any valid operator API key allows access to the full audit log via the store.ListAuditEntries function. This allows an attacker to retrieve sensitive information, including cross-tenant actor names, host/CA/operator IDs, action timestamps, and masked-IP entries from rate-limit refusals. Such data can be used to enumerate server activity, infer staffing patterns, or identify high-value targets.

API Endpoint: '/api/v1/audit-log'

Recommendations Update nebula-mesh to version 0.3.1 or later. As a temporary workaround, restrict access to the '/api/v1/audit-log' endpoint to only trusted administrative users.