CVE-2026-47768

CVE-2026-47768 in Nebula-mesh exposes operator API keys through Referer headers during the key creation redirect flow. When a user creates an API key, the response includes the key in a redirect URL, which gets logged in Referer headers accessible to proxies, browser history, and any system with visibility into HTTP traffic between the client and server. The CVSS 5.5 score is technically accurate but misleading for prioritization if you treat it as a standalone signal. The key insight is this: the exposure vectors — proxy logs, browser history, Referer headers — all require the attacker to already have network adjacency or endpoint compromise. If an attacker can read your proxy logs or browser history, they've already achieved lateral movement or endpoint compromise. The API key exposure becomes nearly incidental at that point. This fundamentally reframes the vulnerability from 'remote unauthenticated credential leak' to 'post-compromise information disclosure.' The exposure window is also brief — keys are only exposed during the creation redirect, not persistently. An attacker would need to be positioned precisely at the moment of key minting, which narrows the practical exploit path significantly for self-hosted deployments where you control the proxy and network path. For your risk decision: prioritize patching based on the maturity and isolation of your Nebula deployment, not the CVSS score alone. In a well-segmented self-hosted environment with controlled proxy access, this warrants attention but not emergency response. In any environment where untrusted users or systems can traverse the HTTP path during key creation, treat this as higher urgency — the threat model assumption of 'attacker needs network adjacency' may not hold.

Reviewed through automated stages and approved by a human before publication.