External risk intelligence

Nebula-Mesh API Privilege Escalation Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-47724

The vulnerability resides in the API endpoints of a self-hosted control plane for a mesh VPN. Such control planes are typically deployed as internet-facing management services or API gateways to facilitate cross-network connectivity, making them commonly accessible via the network to operators and automated systems.

Privilege Escalation

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability exists in nebula-mesh, a self-hosted control plane for VPNs, that could allow unauthorized access to sensitive information and system control. The issue impacts how authorization tokens are handled, potentially enabling a non-administrator to gain broad cross-tenant access. This could lead to privilege escalation within the system.

Access controls are not properly enforced.
It allows broad cross-tenant access.
Confirm relevance and exposure to your VPN mesh.

Attack Path

How an attacker could exploit the issue

An attacker with an operator API key could potentially gain broad access across different tenants within the nebula-mesh system. This is because the API endpoints, specifically those for managing hosts, networks, firewalls, and mobile bundles, do not sufficiently validate the authorization of the bearer token. By leveraging this, an attacker could escalate their privileges and access sensitive information or control functionalities that should be restricted.

Requires an operator API key.
Accesses sensitive API endpoints.
Risk of broad cross-tenant access.

Live Threat

Current exploitation, exposure, and threat context

The nebula-mesh control plane, when running an unpatched version, could allow unauthorized operators to access or modify critical network configurations across different tenants using only a valid operator API key. This is because certain API endpoints do not properly verify an operator's permissions beyond a bearer token.

Network configurations across tenants.
API requests without proper authorization.
Broad cross-tenant access and escalation.

Operational Fix

Recommended remediation, mitigation, and detection steps

Security and Infrastructure teams are most likely responsible for addressing this vulnerability in the self-hosted nebula-mesh control plane. The first practical step is to identify all instances of nebula-mesh, determine their network exposure and business criticality, and then locate the accountable owner for each instance to plan remediation based on assessed risk.

Identify nebula-mesh deployment scope.
Verify API endpoint reachability and access.
Plan remediation based on asset criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is nebula-mesh and how is it used?

nebula-mesh is a self-hosted control plane used to manage Slack Nebula, a mesh virtual private network. It provides a centralized interface and API for network administrators to configure hosts, firewalls, and network properties, essentially acting as the command center for the VPN's connectivity and security settings.

What does CVE-2026-47724 mean for system security?

This vulnerability is classified as Improper Authorization (CWE-862). It means the software fails to verify if a user has permission to access specific resources. In this case, most API endpoints mistakenly trust that any valid bearer token has full access, allowing users to bypass intended restrictions and perform actions they are not authorized to take.

How can an attacker trigger this vulnerability?

An attacker triggers this by using a valid operator API key to send requests to sensitive API endpoints, such as those for host or network management. Accessing the Web UI or endpoints specifically gated by CA ownership checks will not trigger the bug; however, the vulnerability is active across most other host, network, firewall, and mobile-bundle API routes.

Is my nebula-mesh instance at risk?

According to Halo Surface Signal, this component is likely reachable via the network because it is commonly deployed as an internet-facing management service. If your instance is accessible from the network, any operator with a standard API key could potentially gain unauthorized cross-tenant access, making this a critical concern regardless of whether it is public or internal.

What should I do to address this vulnerability?

The most effective way to remediate this issue is to update your nebula-mesh deployment to version 0.3.4 or later, which implements the necessary authorization checks. Before applying the update, verify where your instances are deployed and confirm that you have identified the appropriate team members responsible for managing those specific VPN control plane assets.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.