{"vulnerability": "ghsa-7rx3-5wx3-5v76", "sightings": [{"uuid": "94833a54-2c67-485c-88df-2724d8aa6f25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-7rx3-5wx3-5v76", "type": "seen", "source": "https://gist.github.com/alon710/e9ace864fd0fc758277cc4aa4cece6b7", "content": "# GHSA-7RX3-5WX3-5V76: GHSA-7rx3-5wx3-5v76: Missing Authorization in Nebula-mesh Webhook Subscription API Enables Server-Side Request Forgery\n\n> **CVSS Score:** 7.7\n> **Published:** 2026-07-14\n> **Full Report:** https://cvereports.com/reports/GHSA-7RX3-5WX3-5V76\n\n## Summary\nNebula-mesh allows non-admin operators to disable webhook SSRF (Server-Side Request Forgery) protection via the allow_private parameter. Low-privilege operators can configure webhook endpoints targeting internal endpoints and trigger lifecycle events on resources they own, bypassing network access controls.\n\n## TL;DR\nA missing authorization check in Nebula-mesh allows non-admin operators to toggle the 'allow_private' parameter on webhooks, bypassing SSRF guards and allowing them to target internal systems.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862, CWE-918\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.7\n- **Exploit Status**: poc\n- **Impact**: Server-Side Request Forgery (SSRF)\n\n## Affected Systems\n\n- Nebula-mesh\n- **github.com/forgekeep/nebula-mesh**: >= 0.6.0, <= 0.7.1 (Fixed in: `0.7.2`)\n\n## Mitigation\n\n- Upgrade to Nebula-mesh version 0.7.2 or later to enforce authorization checks on the allow_private webhook setting.\n- Implement host-level firewall rules or container security policies to explicitly block outbound connections to loopback and private subnets from the Nebula-mesh container.\n- Deploy an egress proxy or use network-level policies to enforce strict validation on all HTTP traffic originating from the system.\n\n**Remediation Steps:**\n1. Analyze webhook subscription records in the database for unauthorized entries with 'allow_private' set to true.\n2. Update application dependencies and pull version 0.7.2 of github.com/forgekeep/nebula-mesh.\n3. Restart the Nebula-mesh controller and API server instances to ensure the configuration changes take effect.\n\n## References\n\n- [GitHub Security Advisory GHSA-7rx3-5wx3-5v76](https://github.com/advisories/GHSA-7rx3-5wx3-5v76)\n- [Nebula-mesh Security Advisory](https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-7rx3-5wx3-5v76)\n- [Official Fix Commit](https://github.com/forgekeep/nebula-mesh/commit/f3c54530e388dd21763e548923426e60a8e93ff0)\n- [Nebula-mesh v0.7.2 Release Tag](https://github.com/forgekeep/nebula-mesh/releases/tag/v0.7.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-7RX3-5WX3-5V76) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-14T20:42:32.584280Z"}, {"uuid": "25f54022-2878-44c2-9504-b8fc9892c36b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-7rx3-5wx3-5v76", "type": "seen", "source": "https://gist.github.com/alon710/69a35e6d85f7f0c43de5276d0ac08d9d", "content": "# GHSA-7RX3-5WX3-5V76: GHSA-7rx3-5wx3-5v76: Missing Authorization in Nebula-mesh Webhook Subscription API Enables Server-Side Request Forgery\n\n> **CVSS Score:** 7.7\n> **Published:** 2026-07-14\n> **Full Report:** https://cvereports.com/reports/GHSA-7RX3-5WX3-5V76\n\n## Summary\nNebula-mesh allows non-admin operators to disable webhook SSRF (Server-Side Request Forgery) protection via the allow_private parameter. Low-privilege operators can configure webhook endpoints targeting internal endpoints and trigger lifecycle events on resources they own, bypassing network access controls.\n\n## TL;DR\nA missing authorization check in Nebula-mesh allows non-admin operators to toggle the 'allow_private' parameter on webhooks, bypassing SSRF guards and allowing them to target internal systems.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862, CWE-918\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.7\n- **Exploit Status**: poc\n- **Impact**: Server-Side Request Forgery (SSRF)\n\n## Affected Systems\n\n- Nebula-mesh\n- **github.com/forgekeep/nebula-mesh**: >= 0.6.0, <= 0.7.1 (Fixed in: `0.7.2`)\n\n## Mitigation\n\n- Upgrade to Nebula-mesh version 0.7.2 or later to enforce authorization checks on the allow_private webhook setting.\n- Implement host-level firewall rules or container security policies to explicitly block outbound connections to loopback and private subnets from the Nebula-mesh container.\n- Deploy an egress proxy or use network-level policies to enforce strict validation on all HTTP traffic originating from the system.\n\n**Remediation Steps:**\n1. Analyze webhook subscription records in the database for unauthorized entries with 'allow_private' set to true.\n2. Update application dependencies and pull version 0.7.2 of github.com/forgekeep/nebula-mesh.\n3. Restart the Nebula-mesh controller and API server instances to ensure the configuration changes take effect.\n\n## References\n\n- [GitHub Security Advisory GHSA-7rx3-5wx3-5v76](https://github.com/advisories/GHSA-7rx3-5wx3-5v76)\n- [Nebula-mesh Security Advisory](https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-7rx3-5wx3-5v76)\n- [Official Fix Commit](https://github.com/forgekeep/nebula-mesh/commit/f3c54530e388dd21763e548923426e60a8e93ff0)\n- [Nebula-mesh v0.7.2 Release Tag](https://github.com/forgekeep/nebula-mesh/releases/tag/v0.7.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-7RX3-5WX3-5V76) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-14T20:43:17.536064Z"}]}