github.com/juev/nebula-mesh

nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml `internal/configgen/generator.go:86,108,119` interpolates the operator-supplied `ListenHost` and `TunDevice` fields raw into a `text/template` that produces t…

nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.) None of the response paths in `internal/web/` or `internal/api/` set the standard browser-security headers. `grep` for `Content-Security-Policy…

nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation The `/api/v1/*` route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at `internal/a…

nebula-mesh's web UI lacks CSRF tokens on /ui/* mutating endpoints Every `/ui/*` POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. `SameSite=Lax` on the session cookie prevents most cross-sit…

nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator `internal/api/audit.go:12` — `handleGetAuditLog` does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via `sto…

nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs) `internal/web/operators.go:251` — after `handleOperatorCreateAPIKey` mints a fresh 32-byte bearer token, the redirect points the operator'…

nebula-mesh: Decrypted CA private key persists in heap after signing `internal/pki/resolver.go:36-64` constructs a `CAManager` with the plaintext `ed25519.PrivateKey` after unwrapping via the master key; `internal/pki/ca.go:13-16` stores …

nebula-mesh: Session and OIDC state cookies lack the Secure attribute `internal/web/session.go` and `internal/web/oidc.go` set `HttpOnly` and `SameSite=Lax` on every cookie but never `Secure`. A single plaintext request to the origin (ope…