{"id":"CVE-2026-63464","summary":"Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`","details":"nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators (role user) can set allow_private: true on their own managed webhook subscription (POST/PATCH /api/v1/webhook-subscriptions). No admin check exists on this field. At delivery time, allow_private switches the dispatcher to an unguarded HTTP client, bypassing the private/loopback/link-local SSRF guard — letting a low-privilege operator make the server request internal addresses. This issue has been patched in version 0.7.2.","aliases":["GHSA-7rx3-5wx3-5v76","GO-2026-5985"],"modified":"2026-09-06T03:46:14.902124752Z","published":"2026-09-04T19:44:10.117Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-862","CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63464.json"},"references":[{"type":"WEB","url":"https://github.com/forgekeep/nebula-mesh/releases/tag/v0.7.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63464.json"},{"type":"ADVISORY","url":"https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-7rx3-5wx3-5v76"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63464"},{"type":"FIX","url":"https://github.com/forgekeep/nebula-mesh/commit/f3c54530e388dd21763e548923426e60a8e93ff0"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/forgekeep/nebula-mesh","events":[{"introduced":"9487a7521c94b14973dcf67efb69faae5c8001e9"},{"fixed":"65f3107f887648e23f3bf1a7c9ecc397d958c1ad"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0.6.0"},{"fixed":"0.7.2"}]}}],"versions":["v0.7.1","v0.7.0","v0.6.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63464.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"}]}