CVE-2026-48058

Katalog CVE

CVSS 4.6 · Medium EPSS 0,32%

Kerentanan Sensitive Cookie in HTTPS Session Without 'Secure' Attribute. Skor CVSS 4.0 4.6 (Medium) menurut github.com.

Deskripsi (NVD)

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin (operator on a LAN, mistyped URL, HTTP→HTTPS not strictly enforced, reverse proxy misconfiguration) discloses the session. This issue has been patched in version 0.3.2.

Rincian

Terbit di NVD

28 Juli 2026

Terakhir diubah

30 Juli 2026

Status NVD

Deferred

CVSS 4.0

4.6 (Medium), sumber github.com
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 23,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/forgekeep/nebula-mesh/commit/ffdd67dbf221d9a5855c39fbe11b49c245048d85
• https://github.com/forgekeep/nebula-mesh/releases/tag/v0.3.2
• https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-rqfj-vv8r-xhqc