internal/api/audit.go:12 — handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via store.ListAuditEntries (up to limit=1000). This includes cross-t…
| CVE ID | CVE-2026-47726 |
| Vendor | go |
| Affected Product | github.com/juev/nebula-mesh |
| Vulnerability Type | Vulnerability |
| CVSS Score | 7.5 (HIGH) |
| Actively Exploited | ❌ No known exploitation |
| Patch Status | See Vendor Advisory → |
| Reported By | CYBERDUDEBIVASH SENTINEL APEX Intelligence (via github_advisories) |
internal/api/audit.go:12 — handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via store.ListAuditEntries (up to limit=1000). This includes cross-tenant actor names, host/CA/operator IDs, action timestamps, and masked-IP entries from rate-limit refusals — enough surface for a tenant to enumerate the server's activity, infer staffing patterns, or identify high-value targets.
All released versions up to v0.3.1.
`` curl -H "Authorization: Bearer " \ https://server/api/v1/audit-log?limit=1000 `
Two options, either acceptable: 1. if !actorIsAdmin(ctx) { 403 } — strictest; matches the "operator management is admin-only" stance. 2. Scope to actor: filter store.ListAuditEn
Sigma rules, YARA signatures, IOC table, and SIEM queries for Splunk, Elastic, Sentinel, and Chronicle — deployable in 5 minutes.