CVE-2025-62820: Slack Nebula

Medium severity, CVSS 4.9. EPSS: 0.2% chance of exploitation in the next 30 days.

Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.

Affected products

• Slack Nebula: before 1.9.7 (fixed in 1.9.7)

Published 2025-10-23. Last modified 2026-10-08.