CVE-2026-48058

Name of the Vulnerable Software and Affected Versions nebula-mesh versions prior to 0.3.2

Description Cookies in internal/web/session.go and internal/web/oidc.go are configured with HttpOnly and SameSite=Lax but lack the Secure attribute. This allows a session to be disclosed if a plaintext request is made to the origin, which can occur due to mistyped URLs, lack of strict HTTP to HTTPS enforcement, or reverse proxy misconfigurations. An attacker observing an HTTP request can recover the session cookie to impersonate the operator for the duration of its 24-hour TTL. Additionally, the OIDC state cookie is vulnerable for a 10-minute window, potentially enabling Cross-Site Request Forgery (CSRF) during the OIDC callback. The issue affects the following functions:

Recommendations Update to a version where the cookie secure configuration option is implemented. For operators using a TLS-terminating proxy, explicitly set cookie secure: true to ensure cookies are sent only over secure connections.