CVE-2026-48058

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin (operator on a LAN, mistyped URL, HTTP→HTTPS not strictly enforced, reverse proxy misconfiguration) discloses the session. This issue has been patched in version 0.3.2.

CVSS

No CVSS.

References

Link	Resource
https://github.com/forgekeep/nebula-mesh/commit/ffdd67dbf221d9a5855c39fbe11b49c245048d85
https://github.com/forgekeep/nebula-mesh/releases/tag/v0.3.2
https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-rqfj-vv8r-xhqc
https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-rqfj-vv8r-xhqc

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) nebula-mesh es un plano de control autoalojado para la red privada virtual de malla Slack Nebula. Antes de la versión 0.3.2, internal/web/session.go e internal/web/oidc.go establecían HttpOnly y SameSite=Lax en cada cookie, pero nunca Secure. Una única solicitud en texto plano al origen (operador en una LAN, URL mal escrita, HTTP?HTTPS no estrictamente aplicado, mala configuración del proxy inverso) revela la sesión. Este problema ha sido parcheado en la versión 0.3.2.

Information

Published : 2026-07-28 19:17

Updated : 2026-10-23 23:10

NVD link : CVE-2026-48058

Mitre link : CVE-2026-48058

CVE.ORG link : CVE-2026-48058

JSON object : View

Products Affected

No product.

CWE

CWE-614

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

{"id": "CVE-2026-48058", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48058", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T19:16:35.513464Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "juev", "product": "nebula-mesh", "versions": [{"status": "affected", "version": "< 0.3.2"}]}]}], "published": "2026-07-28T19:17:34.747", "references": [{"url": "https://github.com/forgekeep/nebula-mesh/commit/ffdd67dbf221d9a5855c39fbe11b49c245048d85", "source": "security-advisories@github.com"}, {"url": "https://github.com/forgekeep/nebula-mesh/releases/tag/v0.3.2", "source": "security-advisories@github.com"}, {"url": "https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-rqfj-vv8r-xhqc", "source": "security-advisories@github.com"}, {"url": "https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-rqfj-vv8r-xhqc", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-614"}]}], "descriptions": [{"lang": "en", "value": "nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin (operator on a LAN, mistyped URL, HTTP\u2192HTTPS not strictly enforced, reverse proxy misconfiguration) discloses the session. This issue has been patched in version 0.3.2."}, {"lang": "es", "value": "nebula-mesh es un plano de control autoalojado para la red privada virtual de malla Slack Nebula. Antes de la versi\u00f3n 0.3.2, internal/web/session.go e internal/web/oidc.go establec\u00edan HttpOnly y SameSite=Lax en cada cookie, pero nunca Secure. Una \u00fanica solicitud en texto plano al origen (operador en una LAN, URL mal escrita, HTTP?HTTPS no estrictamente aplicado, mala configuraci\u00f3n del proxy inverso) revela la sesi\u00f3n. Este problema ha sido parcheado en la versi\u00f3n 0.3.2."}], "lastModified": "2026-10-23T23:10:00.157", "sourceIdentifier": "security-advisories@github.com"}