CVE-2026-55512

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.2.0 to before version 0.5.0, when OIDC is enabled, GET /ui/oidc/login is reachable without authentication and is registered outside the Web UI rate-limited auth routes. Every request creates a fresh random OIDC state value and stores it in an in-memory map for 10m. Expired states are swept lazily, but there is no rate limit or maximum live-state cap on the allocation path. An unauthenticated remote client can therefore grow OIDC.states for the full state TTL, bounded by request throughput rather than by configured auth rate limits. This issue has been patched in version 0.5.0.

• CWE-400

• https://github.com/forgekeep/nebula-mesh/commit/bc387086cc0e4b9c1654468b7391af19cacfe367
• https://github.com/forgekeep/nebula-mesh/releases/tag/v0.5.0
• https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-m3cx-mwpg-32jg
• https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-m3cx-mwpg-32jg

Published

Sep 4, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-555019Router is an AI router & token saver. Prior to 0.4.80, the …7.3
• CVE-2026-55502Cloudreve is a self-hosted file management and sharing syste…7.1
• CVE-2026-55509WsgiDAV is a generic and extendable WebDAV server based on W…8.8
• CVE-2026-5551A security flaw has been discovered in itsourcecode Free Hot…7.3
• CVE-2026-55510ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-55511Yamcs is a mission control framework. Prior to 5.12.8 and 5.…9.1
• CVE-2026-55513nebula-mesh is a self-hosted control plane for Slack Nebula …5.4
• CVE-2026-55514vLLM is a library for LLM inference and serving. From 0.12.0…6.5
• CVE-2026-55515Snipe-IT is an IT asset/license management system. Prior to …5
• CVE-2026-55516Snipe-IT is an IT asset/license management system. Prior to …7.7
• CVE-2026-55517Deno is a JavaScript, TypeScript, and WebAssembly runtime. P…4.3
• CVE-2026-55518Avo is a framework to create admin panels for Ruby on Rails …9.6