PT-2026-53022 · Unknown · Nebula-Mesh
CVE-2026-49258
·
Published
2026-06-26
·
Updated
2026-07-30
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Nebula Mesh (affected versions not specified)
Description
The web UI (
/ui/*) fails to apply per-operator Certificate Authority (CA) scoping. This allows any authenticated non-admin operator to access, block, or delete resources belonging to other operators. Specifically, the following endpoints are affected:POST /ui/hosts/{id}/blockandDELETE /ui/hosts/{id}: allow blocking or deleting any host regardless of ownership./ui/hosts,/ui/networks, and/ui/events: expose host names, Nebula IPs, public IPs, certificate fingerprints, expiry dates, network names, and CIDRs across all operators.
The issue resides in the
internal/web handlers: handleHostDetail(), handleHostBlock(), handleHostDelete(), handleDashboard(), handlePartialStats(), handleHosts(), handleNetworks(), renderNetworksError(), and handleHostEvents(). This occurs when at least one non-admin operator exists in the deployment.Recommendations
Scope the affected handlers to the session operator's owned CAs to ensure ownership checks are performed, while maintaining full view for administrators.
As a temporary workaround, restrict access to the
/ui/* endpoints for non-admin operators.Exploit
Fix
Missing Authorization
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Nebula-Mesh