nebula‑mesh is a self‑hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 up to just before 0.7.2, operators with the user role can set the allow_private field to true on their webhook subscription through the POST/PATCH /​api/v1/webhook‑subscriptions endpoint. No privilege check is enforced for this field. When allow_private is enabled, the dispatcher uses an unguarded HTTP client, bypassing the SSRF guard that protects private/loopback/link‑local addresses. The result is that a low‑privilege operator can cause the server to request internal resources. Potentially, such internal requests could expose internal services or sensitive data; this inference follows from the description.

The vulnerability is in the forgekeep Nebula‑mesh product. Users running any version from 0.6.0 up to, but excluding, 0.7.2 are affected. The product’s affected versions are explicitly listed, but no CPE data was provided.

The CVSS score of 7.7 indicates a high‑severity vulnerability. The EPSS score is not available, so the current likelihood of exploitation is uncertain. The vulnerability is not listed in the CISA KEV catalog. Attackers with the user role can exploit the flaw by submitting a valid PATCH request that sets allow_private to true, granting the ability to initiate SSRF requests to internal addresses. No additional authentication or admin privileges are required beyond the user role.