CVE-2026-63464

Name of the Vulnerable Software and Affected Versions nebula-mesh versions 0.6.0 through 0.7.1

Description Non-admin operators with the user role can set the allow private variable to true within their managed webhook subscriptions via the 'POST/PATCH /api/v1/webhook-subscriptions' endpoint. The absence of an administrative check on this field allows the dispatcher to use an unguarded HTTP client during delivery, which bypasses protections against Server-Side Request Forgery (SSRF) targeting private, loopback, or link-local addresses. This enables a low-privilege operator to force the server to make requests to internal network addresses.

Recommendations Update nebula-mesh to version 0.7.2.