Back to overview

CVE-2026-48058

MEDIUM Exploitation: PoC
4.6
CVSS 4.0
Description
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin (operator on a LAN, mistyped URL, HTTP→HTTPS not strictly enforced, reverse proxy misconfiguration) discloses the session. This issue has been patched in version 0.3.2.

Metadata

CVE ID
CVE-2026-48058
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-05-20 18:25 UTC
Published
2026-07-28 18:47 UTC
Last updated
2026-07-28 19:16 UTC
Primary CWE
CWE-614
CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' …
Vendor / Product
juev / nebula-mesh
Sources
cve.org  ·  NVD

Severity & Metrics

4.6 MEDIUM CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
no
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
juev nebula-mesh — < 0.3.2
Weakness (CWE)
CWESourceDescription
CWE-614 cna CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
CVSS scores (1)
ScoreSeverityVersionSourceVector
4.6 MEDIUM 4.0 cna CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
References (3)
Back to overview