CVE-2026-55513: Forgekeep Nebula-Mesh

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path ignores both the server-wide enrollment_token_ttl security setting and per-network network_config.enrollment_token_ttl overrides. API host creation and token-regeneration paths use the configured TTL resolver, but POST /ui/hosts hardcodes now.Add(24 * time.Hour) for newly minted agent enrollment tokens. In deployments that intentionally reduce enrollment-token lifetime, any authenticated operator who can create a host through the Web UI can still mint a bearer enrollment token valid for about 24 hours. This issue has been patched in version 0.5.0.

Affected products

• Forgekeep Nebula-Mesh: from 0.3.0, before 0.5.0 (fixed in 0.5.0)

Published 2026-09-04. Last modified 2026-09-08.