CSRF in Juev Nebula-mesh
CVE-2026-47725
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/* POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on…
Vulnerability class: CSRF (Cross-Site Request Forgery)
Affected products
- Juev Nebula-mesh — versions < 0.3.3
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)