Detections
Analytics

SCA: security update for github.com/forgekeep/nebula-mesh (GHSA-m3cx-mwpg-32jg)

medium Tenable Cloud Security Plugin ID 444721

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.2.0 to before version
 0.5.0, when OIDC is enabled, GET /ui/oidc/login is reachable without authentication and is registered
 outside the Web UI rate-limited auth routes. Every request creates a fresh random OIDC state value and
 stores it in an in-memory map for 10m. Expired states are swept lazily, but there is no rate limit or
 maximum live-state cap on the allocation path. An unauthenticated remote client can therefore grow
 OIDC.states for the full state TTL, bounded by request throughput rather than by configured auth rate
 limits. This issue has been patched in version 0.5.0. (CVE-2026-55512)

Solution

Update the github.com/forgekeep/nebula-mesh library and its related packages to version 0.5.0 or later.

See Also

https://github.com/advisories/GHSA-m3cx-mwpg-32jg

Plugin Details

Severity: Medium

ID: 444721

Version: Revision 1.3

Type: Local

Family: SCA Checks

Published: 7/15/2026

Updated: 9/7/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2026-55512

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/14/2026

Vulnerability Publication Date: 7/14/2026

Reference Information

CVE: CVE-2026-55512

cwe: CWE-400