CVE-2026-55512— nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting
Quick assessment
Affected
forgekeep nebula-mesh
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Forgekeep nebula-mesh是Forgekeep团队的一款构建安全虚拟专用网络的组网工具。 Forgekeep nebula-mesh 0.2.0至0.5.0之前版本存在资源管理错误漏洞，该漏洞源于/ui/oidc/login接口无需认证即可访问且缺少速率限制和最大活动状态限制，可能导致未经验证的远程客户端大量创建OIDC状态值，消耗内存资源，造成拒绝服务。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| forgekeep | nebula-mesh | >= 0.2.0, < 0.5.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-55512
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting
Source: CVE Program / CVE List V5
Vulnerability Description
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.2.0 to before version 0.5.0, when OIDC is enabled, GET /ui/oidc/login is reachable without authentication and is registered outside the Web UI rate-limited auth routes. Every request creates a fresh random OIDC state value and stores it in an in-memory map for 10m. Expired states are swept lazily, but there is no rate limit or maximum live-state cap on the allocation path. An unauthenticated remote client can therefore grow OIDC.states for the full state TTL, bounded by request throughput rather than by configured auth rate limits. This issue has been patched in version 0.5.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Vulnerability Title
Forgekeep nebula-mesh 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Forgekeep nebula-mesh是Forgekeep团队的一款构建安全虚拟专用网络的组网工具。 Forgekeep nebula-mesh 0.2.0至0.5.0之前版本存在资源管理错误漏洞，该漏洞源于/ui/oidc/login接口无需认证即可访问且缺少速率限制和最大活动状态限制，可能导致未经验证的远程客户端大量创建OIDC状态值，消耗内存资源，造成拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| forgekeep | nebula-mesh | >= 0.2.0, < 0.5.0 | - |
|
II. Public POCs for CVE-2026-55512
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55512
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-55512 (1)
Vendor Advisories for CVE-2026-55512 (1)
Vendor Pages for CVE-2026-55512 (1)
-
🔗 Release v0.5.0 · forgekeep/nebula-mesh · GitHub x_refsource_MISC
Same Patch Batch · forgekeep · 2026-09-04 · 7 CVEs total
| CVE-2026-61699 | 8.1 HIGH | nebula-mesh: Certificate revocation is never enforced at the mesh |
| CVE-2026-63464 | 7.7 HIGH | Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_priva |
| CVE-2026-53603 | 7.1 HIGH | nebula-mesh: Operator session tokens stored in plaintext in the database |
| CVE-2026-53604 | 7.1 HIGH | nebula-mesh: CA private key not zeroized on web mobile-bundle error paths |
| CVE-2026-53602 | 6.9 MEDIUM | nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid |
| CVE-2026-55513 | 5.4 MEDIUM | nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hou |
IV. Related Vulnerabilities
Same product: nebula-mesh
-
CVE-2026-63464
Nebula-mesh allows non-admin operators to disable webhook SS -
CVE-2026-61699
nebula-mesh: Certificate revocation is never enforced at the -
CVE-2026-55513
nebula-mesh: Web UI host creation ignores configured enrollm -
CVE-2026-53604
nebula-mesh: CA private key not zeroized on web mobile-bundl -
CVE-2026-53603
nebula-mesh: Operator session tokens stored in plaintext in
Same vendor: forgekeep
-
CVE-2026-63464
Nebula-mesh allows non-admin operators to disable webhook SS -
CVE-2026-61699
nebula-mesh: Certificate revocation is never enforced at the -
CVE-2026-55513
nebula-mesh: Web UI host creation ignores configured enrollm -
CVE-2026-53604
nebula-mesh: CA private key not zeroized on web mobile-bundl -
CVE-2026-53603
nebula-mesh: Operator session tokens stored in plaintext in
Same weakness: CWE-400
-
CVE-2026-115778
Twisted: Unauthenticated Remote Denial of Service in the Twi -
CVE-2026-115776
Twisted: Unauthenticated Remote Denial of Service in the Twi -
CVE-2026-115775
Twisted: Unauthenticated Remote Denial of Service in the Twi -
CVE-2026-115774
Twisted: Denial of Service in the Twisted IMAP4 Server via a -
CVE-2026-115585
pypdf: Possible long runtimes for repeated malformed cross-r
V. Comments for CVE-2026-55512
No comments yet