nebula-mesh: POST /api/v1/hosts/{id}/mobile-bundle response lacks Cache-Control: no-store in github.com/juev/nebula-mesh

Description

References

• juev/nebula-mesh security advisory · ADVISORY
• forgekeep/nebula-mesh commit c13d5b2 · WEB

More vulnerabilities in github.com/juev/nebula-mesh

• CVE-2026-55513MEDIUM 5.4nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI hos…
• CVE-2026-55512MEDIUM 5.3nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.2.0 to before version 0.5.0, when OIDC is enabled, GET …
• CVE-2026-49258HIGH 8.8Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI (/ui/*) does not apply the…
• CVE-2026-48058MEDIUM 4.6nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go an…
• CVE-2026-47768MEDIUM 5.5nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, newly-minted operator API …