GHSA-7rx3-5wx3-5v76: Missing Authorization in Nebula-mesh Webhook Subscription API Enables Server-Side Request Forgery

Vulnerability ID: GHSA-7RX3-5WX3-5V76
CVSS Score: 7.7
Published: 2026-07-14

Nebula-mesh allows non-admin operators to disable webhook SSRF (Server-Side Request Forgery) protection via the allow_private parameter. Low-privilege operators can configure webhook endpoints targeting internal endpoints and trigger lifecycle events on resources they own, bypassing network access controls.

TL;DR

A missing authorization check in Nebula-mesh allows non-admin operators to toggle the 'allow_private' parameter on webhooks, bypassing SSRF guards and allowing them to target internal systems.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-862, CWE-918
• Attack Vector: Network
• CVSS v3.1 Score: 7.7
• Exploit Status: poc
• Impact: Server-Side Request Forgery (SSRF)

Affected Systems

• Nebula-mesh
• github.com/forgekeep/nebula-mesh: >= 0.6.0, <= 0.7.1 (Fixed in: 0.7.2)

Code Analysis

Commit: f3c5453

Merge commit from fork: Gate the allow_private field on isActiveAdmin in both create and update webhook handlers

Exploit Details

• GHSA-7rx3-5wx3-5v76 Advisory Details: Proof of concept showcasing how non-admin operators can trigger outbound webhook requests to arbitrary loopback destinations.

Mitigation Strategies

• Upgrade to Nebula-mesh version 0.7.2 or later to enforce authorization checks on the allow_private webhook setting.
• Implement host-level firewall rules or container security policies to explicitly block outbound connections to loopback and private subnets from the Nebula-mesh container.
• Deploy an egress proxy or use network-level policies to enforce strict validation on all HTTP traffic originating from the system.

Remediation Steps:

1. Analyze webhook subscription records in the database for unauthorized entries with 'allow_private' set to true.
2. Update application dependencies and pull version 0.7.2 of github.com/forgekeep/nebula-mesh.
3. Restart the Nebula-mesh controller and API server instances to ensure the configuration changes take effect.

References

• GitHub Security Advisory GHSA-7rx3-5wx3-5v76
• Nebula-mesh Security Advisory
• Official Fix Commit
• Nebula-mesh v0.7.2 Release Tag

Read the full report for GHSA-7RX3-5WX3-5V76 on our website for more details including interactive diagrams and full exploit analysis.