Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-55512— nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting

Quick assessment

Affected
forgekeep nebula-mesh
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

nebula-mesh 是一个用于 Slack Nebula mesh VPN 的自托管控制平面。在版本 0.2.0 到 0.5.0 之前，当启用 OIDC（OpenID Connect）时， 端点可以在未认证的情况下访问，并且该端点注册在 Web UI 速率限制认证路由之外。每次请求都会生成一个新的随机 OIDC 值，并将其存储在一个内存映射中，有效期为 10 分钟。已过期的状态值会被惰性清理，但在分配路径上既没有速率限制，也没有对存活状态数量的上限。因此，未认证的远程客户端可以通过持续请求来无限制地增加内存中

CVSS 5.3 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
forgekeep nebula-mesh >= 0.2.0, < 0.5.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55512

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting
Source: CVE Program / CVE List V5
Vulnerability Description
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.2.0 to before version 0.5.0, when OIDC is enabled, GET /ui/oidc/login is reachable without authentication and is registered outside the Web UI rate-limited auth routes. Every request creates a fresh random OIDC state value and stores it in an in-memory map for 10m. Expired states are swept lazily, but there is no rate limit or maximum live-state cap on the allocation path. An unauthenticated remote client can therefore grow OIDC.states for the full state TTL, bounded by request throughput rather than by configured auth rate limits. This issue has been patched in version 0.5.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
forgekeep nebula-mesh >= 0.2.0, < 0.5.0 -

II. Public POCs for CVE-2026-55512

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55512

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55512 (1)

Vendor Advisories for CVE-2026-55512 (1)

Vendor Pages for CVE-2026-55512 (1)

Same Patch Batch · forgekeep · 2026-09-04 · 7 CVEs total

CVE-2026-61699 8.1 HIGH nebula-mesh: Certificate revocation is never enforced at the mesh
CVE-2026-63464 7.7 HIGH Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_priva
CVE-2026-53603 7.1 HIGH nebula-mesh: Operator session tokens stored in plaintext in the database
CVE-2026-53604 7.1 HIGH nebula-mesh: CA private key not zeroized on web mobile-bundle error paths
CVE-2026-53602 6.9 MEDIUM nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid
CVE-2026-55513 5.4 MEDIUM nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hou

IV. Related Vulnerabilities

Same product: nebula-mesh
Same vendor: forgekeep
Same weakness: CWE-400

V. Comments for CVE-2026-55512

No comments yet

Leave a comment