CVE-2026-53603

nebula-mesh, a self-hosted control plane for Slack's Nebula mesh VPN, stores operator session tokens in plaintext in the operator_sessions database table, where the token itself serves as the primary key (CWE-312, CWE-522). Because the 32-byte hex token is sent directly in a cookie and remains valid for 24 hours, anyone who can read the database — via backup, snapshot, file copy, or SQL-level disclosure — obtains every currently active token. With a token in hand, an attacker can present it as the session cookie and fully hijack an operator session with no further authentication, gaining operator-level access to the mesh control plane. All self-hosted deployments running a version prior to 0.3.8 are affected. No public proof-of-concept or in-the-wild exploitation is known; EPSS estimates roughly a 0.2% probability of exploitation within 30 days, and the flaw carries a CVSS 4.0 score of 7.1 (High).

What to do: Upgrade to nebula-mesh 0.3.8 or later, then invalidate existing operator sessions (force re-login), since pre-patch plaintext tokens remain valid for up to 24 hours. Restrict read access to the control-plane database and treat its backups, snapshots, and file copies as secrets; if any untrusted party had database read access, assume active operator sessions were compromised and rotate them.