CVE-2026-55513

Name of the Vulnerable Software and Affected Versions nebula-mgmt versions 0.3.0 through 0.3.8

Description The Web UI host-creation path in nebula-mgmt ignores the server-wide enrollment token ttl security setting and per-network network config.enrollment token ttl overrides. While the API paths correctly use the configured TTL resolver, the POST /ui/hosts endpoint hardcodes the expiration of newly created agent enrollment tokens to 24 hours.

Enrollment tokens are bearer credentials used at the POST /api/v1/enroll endpoint to allow a pending host to enroll and receive a signed Nebula certificate and configuration. An authenticated operator with permissions to create hosts via the Web UI can bypass intended security policies to mint tokens with a 24-hour validity, even if the network is configured for a much shorter duration. This increases the risk that an exposed or intercepted token can be used to unauthorizedly enroll a host.

Recommendations For versions 0.3.0 through 0.3.8, refactor the Web UI host-creation path to utilize the same TTL resolution logic used by the API path to ensure enrollment token ttl and network config.enrollment token ttl are honored.