forgekeep nebula-mesh vulnerabilities

Newest CVEs

• CVE-2026-63464

  Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`

  forgekeep · nebula-mesh

  High7.7
• CVE-2026-61699

  nebula-mesh: Certificate revocation is never enforced at the mesh

  forgekeep · nebula-mesh

  High8.1
• CVE-2026-55513

  nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens

  forgekeep · nebula-mesh

  Medium5.4
• CVE-2026-55512

  nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting

  forgekeep · nebula-mesh

  Medium5.3
• CVE-2026-53604

  nebula-mesh: CA private key not zeroized on web mobile-bundle error paths

  forgekeep · nebula-mesh

  High7.1
• CVE-2026-53603

  nebula-mesh: Operator session tokens stored in plaintext in the database

  forgekeep · nebula-mesh

  High7.1
• CVE-2026-53602

  nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate

  forgekeep · nebula-mesh

  Medium6.9