The vulnerability allows the nebula‑mgmt Web UI host‑creation route to ignore the enrollment_token_ttl setting. Tokens minted for new agents are hard‑coded to 24 hours, regardless of any server or network‑specific TTL configuration. This defeat of the intended expiry control means that any authenticated operator creating a host through the UI can obtain an enrollment bearer token that remains valid for an entire day instead of the reduced period they may have set. The resulting breach can give an attacker a persistent foothold in the mesh network or extend the useful life of compromised credentials, raising both confidentiality and integrity risks. The CVSS score of 5.4 indicates a moderate impact.

Forgekeep Nebula‑Mesh versions 0.3.0 through 0.4.x are affected by this issue. The vulnerability was addressed in release 0.5.0 which enforces the configured TTL when minting tokens via the UI.

The CVSS score of 5.4 reflects moderate severity. EPSS is not available, so the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. The exploitation path requires an authenticated operator with Web UI access; an attacker can create a host and receive a 24‑hour bearer token. Once minted, the token can be used to enroll agents or authenticate API calls for up to a day, granting unauthorized network access.