{"id":"GHSA-q4vm-pq3q-8wgq","summary":"nebula-mesh: Operator session tokens stored in plaintext in the database","details":"## Impact\n\nOperator session tokens are stored in plaintext in the `operator_sessions` table (the `token` column is the PRIMARY KEY). The session token is a 32-byte random hex value sent directly in a cookie and valid for 24 hours.\n\n- `internal/models/operator.go:61` — `OperatorSession.Token` holds the plaintext token.\n- `internal/store/sqlite_operators.go:590` — `CreateOperatorSession` inserts `sess.Token` verbatim.\n- `internal/store/sqlite_operators.go:603,642,681,698` — lookups/updates/deletes use `WHERE token = ?` against the plaintext value.\n\nAnyone who can read the database (backup, snapshot, file copy, or SQL-level disclosure) obtains every active session token and can hijack operator sessions directly, with no further authentication.\n\nThis is functionally identical to the plaintext enrollment-token issue fixed in GHSA-ghmh-jhmj-wcmf. API keys (`OperatorAPIKey.KeyHash`) and enrollment tokens (`EnrollmentToken.TokenHash`) already store only a SHA256 hash; session tokens were missed.\n\n## Patches\n\nStore only a SHA256 hash of the session token, mirroring API keys and enrollment tokens:\n1. Add a `HashSessionToken` helper (alongside the existing token-hash helpers).\n2. Migration to add a `token_hash` column.\n3. Update `CreateOperatorSession`, `PromoteOperatorSession`, and `GetOperatorBySession` to write/look up by hash.\n4. Drop the plaintext `token` column in a follow-up migration.\n\nSessions are ephemeral (24h TTL), so all active sessions can be invalidated on deployment — no backward compatibility needed.\n\n## Workarounds\n\nRestrict and encrypt database backups; rotate the operator database. These mitigate exposure but do not fix the underlying storage of plaintext tokens.\n\n## Resources\n\n- `internal/models/operator.go:58-66`\n- `internal/store/sqlite_operators.go:577-698`\n- Migration `005_operators.up.sql:27`\n- Prior related advisory: GHSA-ghmh-jhmj-wcmf","aliases":["CVE-2026-53603","GO-2026-5991"],"modified":"2026-08-24T00:37:04.757826042Z","published":"2026-07-14T20:17:04Z","database_specific":{"github_reviewed_at":"2026-07-14T20:17:04Z","nvd_published_at":null,"cwe_ids":["CWE-312","CWE-522"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-q4vm-pq3q-8wgq"},{"type":"WEB","url":"https://github.com/forgekeep/nebula-mesh/commit/7cb01bab281ded557f8b6c81dab5f48d4c10182e"},{"type":"PACKAGE","url":"https://github.com/forgekeep/nebula-mesh"},{"type":"WEB","url":"https://github.com/forgekeep/nebula-mesh/releases/tag/v0.3.8"}],"affected":[{"package":{"name":"github.com/forgekeep/nebula-mesh","ecosystem":"Go","purl":"pkg:golang/github.com/forgekeep/nebula-mesh"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.3.8"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 0.3.7","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-q4vm-pq3q-8wgq/GHSA-q4vm-pq3q-8wgq.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}