CyberRota Analysis
AI-GeneratedThe vulnerability allows non-admin operators in nebula-mesh versions 0.6.0 to before 0.7.2 to manipulate webhook subscriptions, enabling them to bypass security measures and access internal server addresses. This could lead to unauthorized exposure of sensitive internal resources, posing a significant risk to the integrity of the network. Organizations using affected versions should prioritize upgrading to version 0.7.2 or later to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators (role user) can set allow_private: true on their own managed webhook subscription (POST/PATCH /api/v1/webhook-subscriptions). No admin check exists on this field. At delivery time, allow_private switches the dispatcher to an unguarded HTTP client, bypassing the private/loopback/link-local SSRF guard — letting a low-privilege operator make the server request internal addresses. This issue has been patched in version 0.7.2.