These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-49258 is a high-severity vulnerability in Nebula Mesh, a self-hosted control plane for the Slack Nebula mesh VPN. The issue allows authenticated non-admin operators to access resources belonging to other operators due to improper scoping in the web UI. This was partially addressed by a previous fix but not fully implemented in the web read/mutation surface. A malicious operator could block or del [truncated]
CVE-2026-48058 is a vulnerability in nebula-mesh, a self-hosted control plane for Slack Nebula mesh virtual private network. The issue arises from the improper setting of cookies in internal/web/session.go and internal/web/oidc.go, where HttpOnly and SameSite=Lax are set on every cookie but Secure is never set. This allows for session disclosure over a plaintext request to the origin, such as when an oper [truncated]
CVE-2026-47768 debrief: The nebula-mesh self-hosted control plane for Slack Nebula mesh virtual private network had a vulnerability where newly-minted operator API keys were exposed in redirect URLs (Referer, history, proxy logs) prior to version 0.3.2. This issue was patched in version 0.3.2. Defenders should assess exposure and prioritize upgrading to version 0.3.2 or later, reviewing logs for potential [truncated]
CVE-2026-47726 debrief based on CVE Program and NVD records. The nebula-mesh control plane for Slack Nebula mesh VPN has a high-severity vulnerability prior to version 0.3.2, allowing unauthorized access to audit logs via a bearer-auth gated API route without proper admin checks. This issue enables tenants to potentially enumerate server activity, infer staffing patterns, or identify high-value targets. D [truncated]
CVE-2026-47725 debrief: nebula-mesh vulnerability patched in version 0.3.3. The vulnerability allowed certain types of cross-site form submits and top-level form-submit navigations from third-party pages. Defenders should assess exposure and apply patches for nebula-mesh versions prior to 0.3.3. The issue was patched in version 0.3.3, addressing SameSite=Lax limitations on session cookies and protecting a [truncated]
CVE-2026-48025 debrief based on the supplied source corpus. The CVE record was published on 2026-07-28T18:17:20.583Z and has not been modified since then. The nebula-mesh control plane for Slack Nebula mesh virtual private network has a vulnerability prior to version 0.3.7, where decrypted CA private keys are stored in process heap and can persist for an extended period. This issue allows potential exposu [truncated]
The nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. A critical vulnerability exists in versions prior to 0.3.4, where the `/api/v1/*` route surface trusts the bearer token alone for authorization on most endpoints. This allows for broad cross-tenant access and instant privilege escalation. The codebase admits this at `internal/api/hosts.go:384`. Version 0.3.4 fixe [truncated]