A critical missing authorization vulnerability in nebula-mesh allows authenticated, low-privileged users to perform unauthorized administrative actions, leading to full cross-tenant access.

This is a missing authorization vulnerability (CWE-862) occurring because the API trusts bearer tokens without validating per-tenant ownership for critical operations like host, network, and firewall management.

With a CVSS score of 9.9, this vulnerability represents a severe security failure in a virtual private network control plane. An attacker with minimal privileges could compromise the entire mesh infrastructure, intercept traffic, or reconfigure network policies, leading to a complete breach of confidentiality and integrity for all connected network resources.

Immediate Action: Update the nebula-mesh control plane to version 0.3.4 or later immediately.

Proactive Monitoring: Audit API logs for unusual requests targeting host or CA-management endpoints that originate from non-admin service accounts.

Compensating Controls: Restrict network access to the API management interface to trusted management subnets only until the patch can be applied.

Public Exploit Available: Unknown

The severity of this flaw necessitates an immediate upgrade to version 0.3.4. Administrators should treat this as a high-priority update to prevent unauthorized cross-tenant access within their VPN infrastructure.