CVE-2026-49258: Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN

This month

HIGH 8.8

CVE-2026-49258 is a high-severity flaw (CVSS 8.8) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI (/ui/*) does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5vg, but the changes were not implemented in the web read/mutation surface. Any authenticated non-admin operator (for example, one created via self-registration or OIDC) can access resources belonging to other o

Why this priority

High severity

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	8.8 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	0.5% (top 59%)
CISA exploited list	No
Weakness	CWE-639, CWE-862
Published	2026-07-28
Last modified	2026-10-23

Publisher (CNA): GitHub, Inc.

Timeline

2026-07-28 19:17 UTCPublished CVE record published
2026-10-23 23:10 UTCUpdated Record last modified

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

References

← Back to latest CVEs