Nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. A vulnerability in versions prior to 0.3.2 causes newly minted operator API key to appear in the redirect URL sent to the client. The key is then exposed in the Referer header, browser history, and proxy logs. An attacker who can observe these channels can capture the key and use it to authenticate to the control plane with operator privileges, thereby gaining full administrative control over the mesh network. The weakness is classified as CWE-598 and represents an information disclosure via an insecure transmission mechanism.

The affected vendor is Juev and the product is Nebula‑mesh. Any installation of Nebula‑mesh before version 0.3.2 carries this risk. No specific sub‑versions are listed; the issue exists in all releases from the initial public version up to, but excluding, 0.3.2.

The CVSS score of 5.5 categorizes this vulnerability as moderate, and the EPSS score of less than 1% indicates a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Because the attacker must ingest the redirect URL through client‑side exposure such as browser history or proxy logs, the attack vector is indirect and relies on the attacker having some observational or lateral access to the client or network traffic. If an attacker succeeds, the impact centers on privileged access to the control plane rather than remote code execution. While the risk is moderate, the presence of an exposed credential warrants immediate attention.