nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators (role user) can set allow_private: true on their own managed webhook subscription (POST/PATCH /api/v1/webhook-subscriptions). No admin check exists on this field. At delivery time, allow_private switches the dispatcher to an unguarded HTTP client, bypassing the private/loopback/link-local SSRF guard — letting a low-privilege operator make the server request internal addresses. This issue has been patched in version 0.7.2.

CVE-2026-63464 affects nebula-mesh, a self-hosted control plane for Slack Nebula mesh VPN, in versions 0.6.0 through before 0.7.2. A low-privilege operator (role: user) can set the allow_private field to true on their own webhook subscription via the POST/PATCH /api/v1/webhook-subscriptions API endpoint. No admin authorization check is enforced on this field. When a webhook is dispatched, the allow_private flag causes the server to use an unguarded HTTP client, effectively bypassing SSRF protections that block requests to private, loopback, and link-local addresses. This allows a non-admin user to force the server to make HTTP requests to internal network addresses, enabling Server-Side Request Forgery (SSRF) attacks against internal infrastructure. The vulnerability has been patched in version 0.7.2 of nebula-mesh. Users are advised to upgrade immediately to mitigate the risk of internal network reconnaissance or exploitation via SSRF.