Slack Nebula may accept arbitrary source IP addresses

MÉDIO 4.9CVE-2025-62820 · GHSA-x6fh-7qmf-69xh · GO-2025-4068 · Published 23/10/2025 · updated 08/10/2026

Em resumo

CVE-2025-62820 é uma vulnerabilidade MÉDIO (CVSS 4.9) que afeta github.com/slackhq/nebula.
Chance de exploração nos próximos 30 dias (EPSS): 0.22%, maior que 12.6% das vulnerabilidades.
Correção: atualize para 1.9.7 ou posterior.

Package	Affected versions	Patched versions
github.com/slackhq/nebula Go	`≥ 1.9.4, < 1.9.7`	`1.9.7`

Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.

NVD description

Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.