CVE-2026-63464: Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators (role user) can set allowprivate: true on their own managed webhook subscription (POST/PATCH /api/v1/webhook-subscriptions). No admin check exists on this field. At delivery time, allowprivate switches the dispatcher to an unguarded HTTP client, bypassing the private/loopback/link-local SSRF guard — letting a low-privilege operator make the server request internal addresses. This issue has been patched in version 0.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nebula-meshto a version that resolves this vulnerability.Fixed in 0.7.2 - Configuration
Set allow_private to false for webhook subscriptions to prevent bypassing the private/loopback/link-local SSRF guard; affected versions are from 0.6.0 up to before 0.7.2 where non-admins could set allow_private: true.
nebula-mesh webhook subscription allow_private = false
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated non-admin operator with the user role who can manage their own webhook subscription can exploit it. Exploitation does not require administrator privileges or user interaction.
What must an attacker do to trigger requests to internal addresses?
The operator must create or update one of their webhook subscriptions through the POST or PATCH API and set allow_private to true. When that webhook is delivered, the server uses an unguarded HTTP client that bypasses private, loopback, and link-local address protections.
Which deployments are affected?
Nebula-mesh versions from 0.6.0 through versions before 0.7.2 are affected. Version 0.7.2 contains the patch.
How can I determine whether my deployment may be vulnerable?
Check whether the running nebula-mesh version is earlier than 0.7.2 and whether non-admin user-role operators can manage webhook subscriptions. Review webhook subscription creation and update activity for allow_private set to true.