A critical SSRF vulnerability in the nebula-mesh control plane allows authenticated low-privilege users to bypass security controls and perform internal network requests.

The application fails to perform an authorization check on the allow_private field within webhook subscriptions, which allows authenticated users to disable the internal SSRF guard. By setting this field to true, an attacker can force the server to initiate requests to internal, loopback, or link-local addresses.

This vulnerability carries a CVSS score of 7.7, classifying it as a high-severity risk. Successful exploitation allows an attacker to probe internal network infrastructure that is otherwise protected by the perimeter firewall, potentially leading to the discovery of sensitive services, credential harvesting, or unauthorized data access within the private network.

Immediate Action: Upgrade the nebula-mesh installation to version 0.7.2 or later, which includes the necessary authorization checks for webhook subscriptions.

Proactive Monitoring: Review application access logs for unusual POST or PATCH requests to the /api/v1/webhook-subscriptions endpoint, particularly those originating from accounts with low-privilege operator roles.

Compensating Controls: If immediate patching is not feasible, restrict network access to the nebula-mesh control plane to trusted IP addresses only, and employ a Web Application Firewall to block requests containing suspicious webhook configuration payloads.

Public Exploit Available: Unknown

The vulnerability represents a significant security oversight that effectively neutralizes core network security protections. Administrators must treat this as a high-priority update to prevent potential lateral movement or internal reconnaissance by unauthorized users. Apply the patch to version 0.7.2 immediately to remediate the authorization gap.