Operator session tokens are stored in plaintext within the operator_sessions table, with the token column serving as the primary key. The 32‑byte hex token is transmitted via a cookie and valid for 24 hours. The vulnerability allows an attacker who can read the database—through backup access, file copy, snapshot, or SQL‑level disclosure—to retrieve active session tokens and hijack operator sessions without any further authentication, compromising confidentiality of operator control and potentially affecting the entire VPN control plane.

The affected product is Nebula Mesh, a self‑hosted control plane for Slack Nebula mesh VPN, developed by forgekeep. Versions prior to 0.3.8 contain the flaw; the issue has been addressed in release 0.3.8.

The CVSS score of 7.1 indicates a high severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalogue. The likely attack vector is a database compromise that enables an attacker to read or extract the contents of the operator_sessions table. Once the plaintext tokens are obtained, session hijacking is trivial, as no additional authentication or authorization checks are required. This gives an attacker direct control over operator sessions for up to 24 hours.