Description

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path ignores both the server-wide enrollment_token_ttl security setting and per-network network_config.enrollment_token_ttl overrides. API host creation and token-regeneration paths use the configured TTL resolver, but POST /ui/hosts hardcodes now.Add(24 * time.Hour) for newly minted agent enrollment tokens. In deployments that intentionally reduce enrollment-token lifetime, any authenticated operator who can create a host through the Web UI can still mint a bearer enrollment token valid for about 24 hours. This issue has been patched in version 0.5.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-04T20:17:23.857Z",
  "pubdate": "2026-09-04T20:17:23.857Z",
  "executiveSummary": "A security vulnerability exists in the nebula-mesh control plane affecting versions 0.3.0 through 0.4.x, related to improper enforcement of token time-to-live (TTL) configurations within the Web UI.\nThe vulnerability is classified as an authorization/security policy bypass where the system fails to honor defined enrollment token lifespan restrictions.\nThe impact involves the unauthorized creation of long-lived bearer enrollment tokens, extending beyond the administrative security policy requirements.\nThis affects the nebula-mgmt Web UI host-creation component. Any authenticated operator with access to the Web UI can exploit this, bypassing network-specific or server-wide TTL settings.\nWhile the API components correctly resolve TTL settings, the Web UI hardcodes an arbitrary 24-hour expiration. This creates a risk profile where, regardless of the intended security hardening of the mesh, an attacker or authorized user can mint tokens that persist longer than the organization's security policy permits, potentially facilitating unauthorized node joining if credentials are intercepted.",
  "technicalDetails": "The vulnerability resides within the nebula-mesh host creation logic implemented in the nebula-mgmt Web UI. The root cause is a hardcoded TTL value in the POST /ui/hosts endpoint, which overrides the dynamic configuration resolution logic intended for administrative policy enforcement.\nIn a secure nebula-mesh deployment, the enrollment_token_ttl property—defined either at the server-wide level or overridden within network_config—is designed to govern the lifespan of agent enrollment tokens. While the system's backend API paths correctly invoke the TTL resolver to calculate token expiry, the Web UI implementation bypasses this mechanism entirely by invoking now.Add(24 * time.Hour) directly.\nThe attack flow begins with an authenticated operator or an entity that has compromised an operator's session. The attacker navigates to the Web UI to initiate a new host registration. When the POST request is submitted to the /ui/hosts endpoint, the Web UI server logic ignores the configured, potentially more restrictive TTL (e.g., 1 hour) and generates an enrollment token with a fixed 24-hour validity.\nThis vulnerability is classified as a privilege/policy bypass. Exploitation requires authenticated access to the Web UI, but it does not require administrative privileges beyond those needed to create hosts. By minting a 24-hour token, an attacker can extend the window of opportunity for an agent to successfully join the mesh network, even if security policies specifically mandate short-lived, transient tokens to minimize the impact of token theft or exposure.\nThe exposure is limited to the Web UI; however, in environments relying on short-lived tokens to enforce zero-trust node enrollment, this vulnerability effectively nullifies the security efficacy of the TTL controls. The resulting bearer token allows any agent possessing the key to authenticate against the mesh control plane within that 24-hour window, bypassing intended administrative lifecycle constraints for enrollment credentials."
}