CVE-2025-62820

MEDIUM

Slack Nebula may accept arbitrary source IP addresses

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

CVE-2025-62820 has a selected CVSS score of 4.9 (medium).

Description

Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 23, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Nebula

Browse Slack / Nebula

Default status: unaffected

CVE ListBefore 1.9.7affected

github.com/slackhq/nebula

Browse Go / github.com/slackhq/nebula
GitHub Advisory1.9.4 to < 1.9.7 · Fixed in 1.9.7affected

References

5