GHSA-rqfj-vv8r-xhqc
Fix: forgekeep/nebula-mesh@ffdd67dGHSA-rqfj-vv8r-xhqc is a CWE-614 vulnerability in github.com/juev/nebula-mesh. O3 Security confirms whether GHSA-rqfj-vv8r-xhqc is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
nebula-mesh: Session and OIDC state cookies lack the Secure attribute
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
Real-World Exposure
github.com/juev/nebula-meshReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin (operator on a LAN, mistyped URL, HTTP→HTTPS not strictly enforced, reverse proxy misconfiguration) discloses the session.
Affected
All released versions up to v0.3.1.
Impact
An attacker who can observe one HTTP request to the origin recovers the session cookie and impersonates the operator for the remainder of its 24h TTL. The OIDC state cookie has a narrower 10-minute window but enables CSRF on the OIDC callback during that window.
Cookie sites
internal/web/session.go—Login,StartAuthenticatedSession,CompleteTwoFactor,Logoutinternal/web/oidc.go—HandleLogin(state set),HandleCallback(state clear)
Suggested fix
Driven by an explicit cookie_secure config option, inferred true when tls_cert+tls_key are configured and false otherwise. rate_limit.trust_proxy_header is deliberately not used as a signal — that flag controls XFF parsing for rate-limit IPs and does not promise the proxy speaks TLS to clients. Operator behind a TLS-terminating proxy sets cookie_secure: true explicitly.
Logout and OIDC state-clear cookies also pick up matching HttpOnly + SameSite=Lax so browsers reliably replace the original.
Reproducer
Start nebula-mgmt without tls_cert/tls_key (the documented "behind a reverse proxy" deployment). Hit any login flow over the local listener:
curl -i -X POST -d 'username=admin&password=…' http://127.0.0.1:8080/ui/login
The Set-Cookie: nebula_session=… line will lack Secure. A subsequent unencrypted hop reveals the cookie verbatim.
Operational migration
Operators flipping cookie_secure on a running deployment should expect a one-time logout: existing browser cookies have the old attribute set and the new delete-cookie won't match.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/juev/nebula-mesh | all versions | 0.3.2 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/juev/nebula-mesh. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update github.com/juev/nebula-mesh to 0.3.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-rqfj-vv8r-xhqc is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-rqfj-vv8r-xhqc is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-rqfj-vv8r-xhqc. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-rqfj-vv8r-xhqc in your dependencies?
O3 detects GHSA-rqfj-vv8r-xhqc across Go dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.