Forgekeep vulnerabilities
We track 4 vulnerabilities in Forgekeep products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on September 4, 2026.
Latest Forgekeep vulnerabilities
- 7.7 High severity
nebula-mesh: Missing Authorization
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators (role user) can set allow_private: true on their own managed webhook subscription (POST/PATCH /api/v1/webhook-subscriptions).
- 8.1 High severity
nebula-mesh: Improper Check for Certificate Revocation
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromised/offboarded host from a Nebula mesh. Because the blocklist never reaches any peer's config.yml, a
- 7.1 High severity
nebula-mesh: Improper Removal of Sensitive Information Before Storage or Transfer
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, the web handler renderMobileBundle passes the real *pki.CAResolver directly into mobilebundle.Build. Inside Build, resolver.LoadByID decrypts the CA's ed25519 private
- 7.1 High severity
nebula-mesh: Cleartext Storage of Sensitive Information
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintext in the operator_sessions table (the token column is the PRIMARY KEY). The session token is a 32-byte random hex value