CVE-2026-63464

Nebula-mesh, a self-hosted control plane for the Slack Nebula mesh VPN, fails to restrict the allow_private flag on webhook subscriptions to administrators: between versions 0.6.0 and 0.7.2, a non-admin operator (role "user") can set allow_private: true on their own subscriptions via POST/PATCH /api/v1/webhook-subscriptions (CWE-862). At delivery time, that flag switches the dispatcher to an unguarded HTTP client that skips the SSRF guard for private, loopback, and link-local addresses (CWE-918), so a low-privilege operator can make the server send requests to internal addresses. An attacker with an operator account therefore gains the ability to have the server probe or reach internal network services, which can disclose sensitive internal information — consistent with the high confidentiality impact (and no integrity/availability impact) in the 7.7 High CVSS score. Only self-hosted nebula-mesh deployments running the affected versions are exposed, and only those with non-admin operators able to manage webhook subscriptions. There is no known exploitation in the wild, no public proof of concept, and a low EPSS estimate of 0.3% for exploitation within 30 days.

What to do: Upgrade to nebula-mesh 0.7.2 or later, which adds the missing admin check on allow_private. As an interim mitigation, restrict creation and editing of webhook subscriptions to administrators, and audit existing subscriptions for allow_private set to true by role-user accounts. If such entries exist, investigate whether the server was used to reach internal or cloud metadata endpoints.