CVE-2026-47768

{
  "id": "CVE-2026-47768",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-28T19:17:34.567",
  "lastModified": "2026-10-23T23:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs). This issue has been patched in version 0.3.2."
    },
    {
      "lang": "es",
      "value": "nebula-mesh es un plano de control autoalojado para la red privada virtual de malla Slack Nebula. Antes de la versión 0.3.2, la clave API de operador recién generada quedaba expuesta en la URL de redirección (Referer, historial, registros de proxy). Este problema ha sido parcheado en la versión 0.3.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "juev",
          "product": "nebula-mesh",
          "versions": [
            {
              "version": "< 0.3.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-28T18:47:43.815226Z",
          "id": "CVE-2026-47768",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-598"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/forgekeep/nebula-mesh/releases/tag/v0.3.2",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-9pg3-25fq-p6cc",
      "source": "[email protected]"
    }
  ]
}