What’s Vulnerable › Products

forgekeep nebula-mesh vulnerabilities

7 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your forgekeep nebula-mesh version is affected

Latest forgekeep nebula-mesh vulnerabilities

• CVE-2026-63464 — Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private` (CVSS 7.7)
• CVE-2026-61699 — nebula-mesh: Certificate revocation is never enforced at the mesh (CVSS 8.1)
• CVE-2026-55513 — nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens (CVSS 5.4)
• CVE-2026-55512 — nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting (CVSS 5.3)
• CVE-2026-53604 — nebula-mesh: CA private key not zeroized on web mobile-bundle error paths (CVSS 7.1)
• CVE-2026-53603 — nebula-mesh: Operator session tokens stored in plaintext in the database (CVSS 7.1)
• CVE-2026-53602 — nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate (CVSS 6.9)