CVE-2026-55513

    Dashboard / Vulnerabilities / CVE-2026-55513

    CVE-2026-55513

    Published: 4 Sept 2026Last Modified: 10 Sept 2026

    Summary: nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens

    Details: nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path ignores both the server-wide enrollment_token_ttl security setting and per-network network_config.enrollment_token_ttl overrides. API host creation and token-regeneration paths use the configured TTL resolver, but POST /ui/hosts hardcodes now.Add(24 * time.Hour) for newly minted agent enrollment tokens. In deployments that intentionally reduce enrollment-token lifetime, any authenticated operator who can create a host through the Web UI can still mint a bearer enrollment token valid for about 24 hours. This issue has been patched in version 0.5.0.

    References: https://github.com/forgekeep/nebula-mesh/releases/tag/v0.5.0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55513.json, https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-g4x6-jcvr-9m3g, https://nvd.nist.gov/vuln/detail/CVE-2026-55513, https://github.com/forgekeep/nebula-mesh/commit/514006029e09f1991122b86a80e7b25970bcfa98

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 071db75dc49b1f677a307af28d91d70d20c89163
    Fixed -7186b86821fc210f191eb44bcb52ef108149f02c

    Affected versions

    v0.4.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-55513 | CVE-DB