High severityGHSA Advisory· Published Jul 23, 2026· Updated Jul 30, 2026
CVE-2026-47723
CVE-2026-47723
Description
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in internal/web/ or internal/api/ set the standard browser-security headers. grep for Content-Security-Policy, X-Frame-Options, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy returns zero matches across the codebase. Version 0.3.1 fixes the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/juev/nebula-meshGo | < 0.3.1 | 0.3.1 |
Affected products
2- Range: <= 0.3.0
- osv-coordsRange: < 0.0.20260723T184607-160000.1.1
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-w7w5-5gcp-38rwghsaADVISORY
- github.com/forgekeep/nebula-mesh/commit/b45fda5476c41ffcff1ca23058aef0fb851359c1nvdWEB
- github.com/forgekeep/nebula-mesh/releases/tag/v0.3.1nvdWEB
- github.com/juev/nebula-mesh/security/advisories/GHSA-w7w5-5gcp-38rwghsaWEB
- github.com/forgekeep/nebula-mesh/security/advisories/GHSA-w7w5-5gcp-38rwnvd
News mentions
0No linked articles in our index yet.