CRITICAL

CVE-2026-47724

CVSS v3

9.9

CRITICAL

EPSS Score

0.4%

exploit probability

CISA KEV

No

known exploited

Exploitation

SSVC status

Description

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the `/api/v1/*` route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at `internal/api/hosts.go:384`: "API trusts the bearer token for authorisation; per-CA ownership is enforced only in the Web layer." The Web UI gates state-changing routes through `loadAccessibleCA` (`internal/web/cas.go`); CA-management endpoints in `inter

Technical details

CVSS v3 Vector
3.1
Published
7/23/2026
Last Modified
7/23/2026

Frequently asked questions

What is CVE-2026-47724?

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the `/api/v1/*` route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at `internal/api/hosts.go:384`: "API trusts the bearer token for authorisation; per-CA ownership is enforced only in the Web layer." The Web UI gates state-changing routes through `loadAccessibleCA` (`internal/web/cas.go`); CA-management endpoints in `inter

Is CVE-2026-47724 actively exploited?

Active exploitation of CVE-2026-47724 has not been confirmed. The EPSS score is 0.4%, indicating the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2026-47724?

CVE-2026-47724 has a CVSS v3 base score of 9.9 (CRITICAL severity), with vector string 3.1.

Is CVE-2026-47724 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.