PatchSiren

juev CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL juev CVE published 2026-07-23

CVE-2026-47724

The nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. A critical vulnerability exists in versions prior to 0.3.4, where the `/api/v1/*` route surface trusts the bearer token alone for authorization on most endpoints. This allows for broad cross-tenant access and instant privilege escalation. The codebase admits this at `internal/api/hosts.go:384`. Version 0.3.4 fixe [truncated]