CVE-2026-55513

Go/github.com/forgekeep/nebula-mesh CVE-2026-55513: medium 5.4

nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens

Action: Upgrade github.com/forgekeep/nebula-mesh to 0.5.0 or later.

go get github.com/forgekeep/nebula-mesh@v0.5.0

Affected

Fixed versions

Sources

• osv: GHSA-g4x6-jcvr-9m3g
• https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-g4x6-jcvr-9m3g
• https://github.com/forgekeep/nebula-mesh/commit/514006029e09f1991122b86a80e7b25970bcfa98
• https://github.com/forgekeep/nebula-mesh
• https://github.com/forgekeep/nebula-mesh/releases/tag/v0.5.0

CVE-2026-55513 · published 2026-07-14T20:26:21Z · modified 2026-07-23T18:11:42.592571840Z · JSON

Go/github.com/forgekeep/nebula-mesh CVE-2026-55513: unknown

Insecure enrollment token TTL in nebula-mesh in github.com/forgekeep/nebula-mesh

Action: Upgrade github.com/forgekeep/nebula-mesh to 0.5.0 or later.

go get github.com/forgekeep/nebula-mesh@v0.5.0

Affected

Fixed versions

Sources

• osv: GO-2026-5987
• https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-g4x6-jcvr-9m3g
• https://github.com/forgekeep/nebula-mesh/commit/514006029e09f1991122b86a80e7b25970bcfa98
• https://github.com/forgekeep/nebula-mesh/releases/tag/v0.5.0

CVE-2026-55513 · published 2026-07-23T17:34:12Z · modified 2026-07-23T18:00:23.848180658Z · JSON

Go/github.com/juev/nebula-mesh CVE-2026-55513: unknown

Insecure enrollment token TTL in nebula-mesh in github.com/forgekeep/nebula-mesh

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-5987#Go/github.com/juev/nebula-mesh
• https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-g4x6-jcvr-9m3g
• https://github.com/forgekeep/nebula-mesh/commit/514006029e09f1991122b86a80e7b25970bcfa98
• https://github.com/forgekeep/nebula-mesh/releases/tag/v0.5.0

CVE-2026-55513 · published 2026-07-23T17:34:12Z · modified 2026-07-23T18:00:23.848180658Z · JSON