The vulnerability arises from the lack of an administrative authorization check in the handler for the audit‑log endpoint in nebula‑mesh. Any bearer‑only operator key is able to issue a GET request to /api/v1/audit-log and retrieve up to 1000 audit entries. The returned data contains cross‑tenant actor names, host and CA/operator identifiers, timestamps, and even masked IP addresses from rejected rate‑limit attempts. This capability allows a tenant to map the server’s activity, infer internal staffing patterns, or locate high‑value actors, thereby compromising confidentiality.

Affected software is the self‑hosted control plane for Slack Nebula mesh virtual private networks developed by juev. Versions prior to 0.3.2 are vulnerable; the patch that adds the missing admin check is included in release 0.3.2 and later. All deployments of juev:nebula‑mesh running these older versions are susceptible.

The CVSS base score is 7.1, indicating a high risk to confidentiality. The EPSS score is less than 1%, suggesting that exploitation is currently unlikely but still possible. Because the issue is not listed in CISA’s KEV catalog, large‑scale public exploitation has not yet been documented. The attack surface is an authenticated API request; an attacker only needs a valid operator bearer token, which is typically obtainable by compromising any tenant or by misconfiguration.