CyberRota Analysis
AI-GeneratedThe nebula-mesh control plane for Slack Nebula mesh VPN is vulnerable due to operator session tokens being stored in plaintext within the database, allowing unauthorized access to active sessions. Attackers with database read access can hijack operator sessions without additional authentication, posing a significant security risk. Organizations using versions prior to 0.3.8 should prioritize upgrading to the patched version to mitigate this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintext in the operator_sessions table (the token column is the PRIMARY KEY). The session token is a 32-byte random hex value sent directly in a cookie and valid for 24 hours. Anyone who can read the database (backup, snapshot, file copy, or SQL-level disclosure) obtains every active session token and can hijack operator sessions directly, with no further authentication. This issue has been patched in version 0.3.8.