https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-30T01:49:56.339341+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-63464 fkie_cve-2026-63464 2026-09-30T01:49:56.356995+00:00

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators (role user) can set allow_private: true on their own managed webhook subscription (POST/PATCH /api/v1/webhook-subscriptions). No admin check exists on this field. At delivery time, allow_private switches the dispatcher to an unguarded HTTP client, bypassing the private/loopback/link-local SSRF guard — letting a low-privilege operator make the server request internal addresses. This issue has been patched in version 0.7.2.

 https://db.gcve.eu/vuln/ghsa-7rx3-5wx3-5v76 GHSA-7rx3-5wx3-5v76 — Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private` 2026-09-30T01:49:56.357066+00:00

Affected: Go: github.com/forgekeep/nebula-mesh

### Summary

Non-admin operators (role `user`) can set `allow_private: true` on their own managed webhook subscription (`POST`/`PATCH /api/v1/webhook-subscriptions`). No admin check exists on this field. At delivery time, `allow_private` switches the dispatcher to an unguarded HTTP client, bypassing the private/loopback/link-local SSRF guard — letting a low-privilege operator make the server request internal addresses.

### Details

`internal/api/webhooks.go:67` (`handleCreateWebhookSubscription`) and `:110` (`handleUpdateWebhookSubscription`) persist operator-supplied `AllowPrivate` with no role check — only ownership is enforced (`canAccessWebhookSub`), and that's not even called on create.

`internal/webhook/webhook.go:294-296`: ```go client := d.guarded if tgt.AllowPrivate { client = d.unguarded } ``` `d.unguarded` skips the loopback/private/link-local rejection `config.ValidateWebhookURL` otherwise enforces.

Every other tenant-impacting toggle (network create `internal/api/networks.go:21`, settings PATCH `internal/api/settings.go:36`, CA management) gates on `isActiveAdmin`. `allow_private` is the exception — introduced with managed webhook subscriptions (PR #258) and missed by the two prior fixes for the same authz-gap class in this repo (GHSA-598g-h2vc-h5vg, GHSA-c6v2-3ffm-vcmc).

### PoC

Verified live against a real running instance of nebula-mesh (HEAD `2c3457c`, built and run locally, no third-party requests made — the "internal service" below is a loopback l…