—
GO-2026-5987
Insecure enrollment token TTL in nebula-mesh in github.com/forgekeep/nebula-mesh
Quick fix
GO-2026-5987 — github.com/forgekeep/nebula-mesh: upgrade to the fixed version with the command below.
go get github.com/forgekeep/nebula-mesh@v0.5.0Details
The nebula-mesh Web UI host creation ignores the configured enrollment token TTL and instead mints 24-hour bearer enrollment tokens. This can lead to tokens remaining valid for longer than intended, increasing the window of opportunity for an attacker to use an intercepted token.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / github.com/forgekeep/nebula-mesh
Introduced in:
0.4.0 Fixed in: 0.5.0 Fix
go get github.com/forgekeep/nebula-mesh@v0.5.0 Go / github.com/juev/nebula-mesh
Introduced in:
0.3.0 No fixed version published yet for github.com/juev/nebula-mesh (go modules). Pin to a known-safe version or switch to an alternative.