Nebula Mesh versions prior to 0.3.3 process every POST, PUT, PATCH or DELETE request under /ui/* immediately after a valid session cookie is presented, without checking for a CSRF token. While the session cookie is set with SameSite=Lax, that setting does not stop top‑level form submissions from third‑party pages, nor does it block requests from same‑registrable‑domain attackers such as sibling‑subdomain XSS or subdomain takeover. A third‑party site can also force a logout by loading the GET /ui/logout endpoint via an <img> tag. From this, an attacker who can coerce a victim’s browser to issue authenticated requests to those endpoints can alter configuration, log users out, or perform other state changes, which is a classic CSRF flaw (CWE‑352). The issue was fixed in the 0.3.3 release.

The vulnerability affects the Nebula Mesh control plane distributed by juev. Versions older than 0.3.3 are vulnerable; the issue was patched in the 0.3.3 release.

The CVSS v3 score of 6.9 indicates moderate severity, and an EPSS score of < 1% shows a low but non‑zero chance of exploitation at the time of this analysis. The attack requires the victim to have a valid session cookie and the ability to force a request to /ui/*, which can be achieved through top‑level form submissions or third‑party content such as an image tag. The vulnerability is not listed in the CISA KEV catalog. Because the flaw can be triggered by third‑party content, the risk remains moderate in mixed‑origin environments.