# nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml

Operator-supplied TunDevice/ListenHost fields are interpolated raw into a text/template generating agent config.yml, letting an operator inject YAML keys like lighthouse/relay flags.

- Payout: Research
- Severity: high
- Program: nebula-mesh
- Found by: ak2k
- Disclosed: 2026-06-08
- CVE: CVE-2026-47722
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-7hp6-g3pq-3pc3
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-7hp6-g3pq-3pc3
- Tags: area:web domain:web impact:integrity impact:privesc kind:research platform:ghsa sev:high tech:go technique:chained technique:source-review vuln:misconfiguration vuln:privilege-escalation

**Target:** config generation template / advanced host override form endpoint
**Root cause:** internal/configgen/generator.go interpolates ListenHost and TunDevice raw into a text/template producing config.yml; internal/web/advanced.go only TrimSpace-validates them, so newline-containing values inject arbitrary YAML keys.
**Steps:**
1. Set `adv_tun_device` to `nebula0\nlighthouse:\n  am_lighthouse: true\n  hosts: ["10.0.0.1"]\n#` via the advanced overrides form
2. Agent fetches rendered config on next signed poll
3. On config reload the injected YAML keys load, self-promoting host to lighthouse or setting am_relay: true
4. Same shape applies to ListenHost
**How found:** Code review of configgen template interpolation and advanced.go validation; noted unsafe_routes already uses netip.Parse validation while other advanced fields do not.
**Exploitation:** Attacker with an operator key submits crafted TunDevice/ListenHost values; the server renders them into config.yml and the agent unconditionally trusts and loads the injected lighthouse/relay keys, granting privilege uplift within the tenant or, chained with the authz advisory, into another tenant.
**Escalation:** Chained with the critical /api/v1 authz advisory, any operator key can mutate another tenant's host overrides and inject YAML there; persists post-authz-fix since agent trusts server config unconditionally.
**Insight:** When a config generator uses text/template string-concat, any field lacking strict shape validation is a YAML injection sink; check sibling fields for existing strict validators (e.g. netip.Parse) as a signal of inconsistent discipline.

## Proof of concept (copied exactly from the original report)

**YAML injection payload for adv_tun_device**

```
nebula0
lighthouse:
  am_lighthouse: true
  hosts: ["10.0.0.1"]
#
```