CVE-2026-47768

Name of the Vulnerable Software and Affected Versions nebula-mesh versions prior to 0.3.2

Description After the handleOperatorCreateAPIKey function in internal/web/operators.go:251 generates a 32-byte bearer token, the application redirects the browser to the endpoint /ui/operators/<id>?new key=<raw-token>&key name=<name>. This process exposes the raw API key in the browser URL history, the Referer header of cross-origin assets, and reverse-proxy or load-balancer access logs. Additionally, the name parameter (sourced from r.FormValue("name")) is appended to the query string without proper encoding via url.QueryEscape, which can lead to query parsing corruption or response header splitting in older proxies if the input contains specific characters.

Recommendations Update to version 0.3.2 or later. As a temporary mitigation, avoid creating new operator API keys until the software is updated. Ensure that the name parameter is processed using url.QueryEscape to prevent query corruption.