CVE-2026-55513

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path ignores both the server-wide enrollment_token_ttl security setting and per-network network_config.enrollment_token_ttl overrides. API host creation and token-regeneration paths use the configured TTL resolver, but POST /ui/hosts hardcodes now.Add(24 * time.Hour) for newly minted agent enrollment tokens. In deployments that intentionally reduce enrollment-token lifetime, any authenticated operator who can create a host through the Web UI can still mint a bearer enrollment token valid for about 24 hours. This issue has been patched in version 0.5.0.

• CWE-613

• https://github.com/forgekeep/nebula-mesh/commit/514006029e09f1991122b86a80e7b25970bcfa98
• https://github.com/forgekeep/nebula-mesh/releases/tag/v0.5.0
• https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-g4x6-jcvr-9m3g
• https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-g4x6-jcvr-9m3g

Published

Sep 4, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55502Cloudreve is a self-hosted file management and sharing syste…7.1
• CVE-2026-55509WsgiDAV is a generic and extendable WebDAV server based on W…8.8
• CVE-2026-5551A security flaw has been discovered in itsourcecode Free Hot…7.3
• CVE-2026-55510ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-55511Yamcs is a mission control framework. Prior to 5.12.8 and 5.…9.1
• CVE-2026-55512nebula-mesh is a self-hosted control plane for Slack Nebula …5.3
• CVE-2026-55514vLLM is a library for LLM inference and serving. From 0.12.0…6.5
• CVE-2026-55515Snipe-IT is an IT asset/license management system. Prior to …5
• CVE-2026-55516Snipe-IT is an IT asset/license management system. Prior to …7.7
• CVE-2026-55517Deno is a JavaScript, TypeScript, and WebAssembly runtime. P…4.3
• CVE-2026-55518Avo is a framework to create admin panels for Ruby on Rails …9.6
• CVE-2026-55519Snipe-IT is an IT asset/license management system. Prior to …5.4