GHSA-7rx3-5wx3-5v76: Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`

July 14, 2026

Non-admin operators (role user) can set allow_private: true on their own managed webhook subscription (POST/PATCH /api/v1/webhook-subscriptions). No admin check exists on this field. At delivery time, allow_private switches the dispatcher to an unguarded HTTP client, bypassing the private/loopback/link-local SSRF guard — letting a low-privilege operator make the server request internal addresses.

References

github.com/advisories/GHSA-7rx3-5wx3-5v76
github.com/forgekeep/nebula-mesh/commit/f3c54530e388dd21763e548923426e60a8e93ff0
github.com/forgekeep/nebula-mesh/releases/tag/v0.7.2
github.com/forgekeep/nebula-mesh/security/advisories/GHSA-7rx3-5wx3-5v76

Code Behaviors & Features

Detect and mitigate GHSA-7rx3-5wx3-5v76 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →