CVE-2026-63464

    Dashboard / Vulnerabilities / CVE-2026-63464

    CVE-2026-63464

    Published: 4 Sept 2026Last Modified: 10 Sept 2026

    Summary: Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`

    Details: nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators (role user) can set allow_private: true on their own managed webhook subscription (POST/PATCH /api/v1/webhook-subscriptions). No admin check exists on this field. At delivery time, allow_private switches the dispatcher to an unguarded HTTP client, bypassing the private/loopback/link-local SSRF guard — letting a low-privilege operator make the server request internal addresses. This issue has been patched in version 0.7.2.

    References: https://github.com/forgekeep/nebula-mesh/releases/tag/v0.7.2, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63464.json, https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-7rx3-5wx3-5v76, https://nvd.nist.gov/vuln/detail/CVE-2026-63464, https://github.com/forgekeep/nebula-mesh/commit/f3c54530e388dd21763e548923426e60a8e93ff0

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 9487a7521c94b14973dcf67efb69faae5c8001e9
    Fixed -65f3107f887648e23f3bf1a7c9ecc397d958c1ad

    Affected versions

    v0.7.1
    v0.7.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-63464 | CVE-DB