Which SIEM platforms have a CVE-2026-47724 detection rule?

df00tech provides CVE-2026-47724 (nebula-mesh API Ownership Check Bypass — Cross-Operator Privilege Escalation) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the CVE-2026-47724 detection?

The CVE-2026-47724 detection is rated critical severity with medium confidence.

What are common false positives for CVE-2026-47724?

Common false positives for CVE-2026-47724 include: Legitimate administrative operators performing bulk mesh configuration changes across many nodes; Automated orchestration tools or CI/CD pipelines managing nebula-mesh resources at scale; Security scanners or asset inventory tools enumerating API endpoints.

CVE-2026-47724

nebula-mesh API Ownership Check Bypass — Cross-Operator Privilege Escalation

Q: What data sources are required to detect nebula-mesh API Ownership Check Bypass — Cross-Operator Privilege Escalation (CVE-2026-47724)?

Detecting nebula-mesh API Ownership Check Bypass — Cross-Operator Privilege Escalation requires the following data sources: Microsoft Sentinel, Microsoft Defender for Endpoint, Azure Active Directory Audit Logs.

Privilege Escalation Persistence Lateral Movement Last updated: June 21, 2026

CVE-2026-47724 is a missing authorization vulnerability (CWE-862) in github.com/juev/nebula-mesh versions prior to 0.3.4. API endpoints fail to validate resource ownership before processing requests, allowing an authenticated operator to access, modify, or delete mesh network resources belonging to other operators. With a CVSS score of 9.9 and a public proof-of-concept, exploitation enables full cross-tenant privilege escalation within a nebula-mesh deployment. Organizations running nebula-mesh as a multi-tenant overlay network orchestrator are at critical risk.

Vulnerability Intelligence

Public PoC

CVE

CVE-2026-47724↗ NVD

Affected Software

Vendor: go
Product: github.com/juev/nebula-mesh
Versions: < 0.3.4

Weakness (CWE)

CWE-862

Timeline

Disclosed: June 8, 2026

References & Proof of Concept

CVSS

9.9

Critical (9.0–10)

Read the write-up →

What is CVE-2026-47724 nebula-mesh API Ownership Check Bypass — Cross-Operator Privilege Escalation?

nebula-mesh API Ownership Check Bypass — Cross-Operator Privilege Escalation (CVE-2026-47724) maps to the Privilege Escalation and Persistence and Lateral Movement tactics — the adversary is trying to gain higher-level permissions in MITRE ATT&CK.

This page provides production-ready detection logic for nebula-mesh API Ownership Check Bypass — Cross-Operator Privilege Escalation, covering the data sources and telemetry it touches: Microsoft Sentinel, Microsoft Defender for Endpoint, Azure Active Directory Audit Logs. The queries below are rated critical severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic: Privilege Escalation Persistence Lateral Movement

Microsoft Sentinel / Defender

kusto

union DeviceNetworkEvents, DeviceProcessEvents, AuditLogs
| where TimeGenerated > ago(7d)
| where (
    (ActionType in ("HttpRequest", "ApiCall") and
     RequestUri matches regex @"/api/v[0-9]+/(nodes|networks|tunnels|hosts|peers)/[^/]+" and
     HttpMethod in ("PUT", "PATCH", "DELETE", "GET") and
     ResultDescription has_any ("200", "201", "204"))
    or
    (ProcessCommandLine has "nebula-mesh" and ProcessCommandLine has_any ("--api", "--token", "--operator"))
)
| extend ParsedUri = extract(@"/api/v[0-9]+/([^/]+)/([^/?]+)", 0, RequestUri)
| summarize
    RequestCount = count(),
    DistinctResources = dcount(ParsedUri),
    DistinctMethods = make_set(HttpMethod),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by AccountName, AccountObjectId, InitiatingProcessAccountName, SourceIp = RemoteIP, bin(TimeGenerated, 10m)
| where DistinctResources > 5
| extend RiskScore = case(
    DistinctResources > 20, "High",
    DistinctResources > 10, "Medium",
    "Low"
)
| project TimeGenerated, AccountName, AccountObjectId, SourceIp, RequestCount, DistinctResources, DistinctMethods, RiskScore, FirstSeen, LastSeen
| order by DistinctResources desc

Detects potential exploitation of CVE-2026-47724 by identifying authenticated users or service accounts making API requests to nebula-mesh resource endpoints across multiple distinct resource IDs in a short window, which may indicate cross-operator ownership bypass. Also surfaces nebula-mesh process invocations with API/token flags.

critical severity medium confidence

Data Sources

Microsoft Sentinel Microsoft Defender for Endpoint Azure Active Directory Audit Logs

Required Tables

DeviceNetworkEvents DeviceProcessEvents AuditLogs

False Positives

Legitimate administrative operators performing bulk mesh configuration changes across many nodes
Automated orchestration tools or CI/CD pipelines managing nebula-mesh resources at scale
Security scanners or asset inventory tools enumerating API endpoints
Network monitoring solutions polling multiple nebula-mesh node statuses simultaneously

Splunk

spl

index=* sourcetype IN ("nebula-mesh:api", "nginx:access", "haproxy", "golang:app", "syslog")
| regex _raw="/api/v\d+/(nodes|networks|tunnels|hosts|peers)/[^/\s]+"
| rex field=_raw "(?P<http_method>GET|POST|PUT|PATCH|DELETE) (?P<request_uri>/api/[^\s]+) HTTP" 
| rex field=_raw "\"?(?P<status_code>[245]\d{2})\"?"
| rex field=_raw "Authorization: Bearer (?P<token_prefix>[A-Za-z0-9+/]{8})"
| rex field=_raw "(?P<operator_id>operator[_-]?[a-zA-Z0-9]+|user[_-]?id[=:]\s*[a-zA-Z0-9]+)"
| rex field=request_uri "/api/v\d+/[^/]+/(?P<resource_id>[^/?\s]+)"
| where status_code IN ("200", "201", "204") AND http_method IN ("PUT", "PATCH", "DELETE", "GET")
| stats
    count AS request_count,
    dc(resource_id) AS distinct_resources,
    values(http_method) AS methods_used,
    values(resource_id) AS resources_accessed,
    earliest(_time) AS first_seen,
    latest(_time) AS last_seen
    BY src_ip, operator_id, token_prefix, span=10m
| where distinct_resources > 5
| eval risk=case(distinct_resources > 20, "HIGH", distinct_resources > 10, "MEDIUM", true(), "LOW")
| eval cve="CVE-2026-47724"
| table _time, src_ip, operator_id, request_count, distinct_resources, methods_used, risk, cve, first_seen, last_seen
| sort -distinct_resources

Identifies nebula-mesh API requests where a single operator or source IP accesses an anomalously high number of distinct resource IDs in a 10-minute window, indicative of cross-operator enumeration or privilege escalation via CVE-2026-47724.

critical severity medium confidence

Data Sources

Splunk Enterprise Splunk Cloud HTTP access logs Application logs

Required Sourcetypes

nebula-mesh:api nginx:access haproxy golang:app syslog

False Positives

Bulk administrative operations by legitimate mesh operators managing large deployments
Automated health-check or monitoring scripts polling many node endpoints
Legitimate DevOps pipeline activity during mesh provisioning or decommissioning
Security red team or penetration testing activity on authorized engagement

Sigma rule & cross-platform mapping

The detection logic for nebula-mesh API Ownership Check Bypass — Cross-Operator Privilege Escalation (CVE-2026-47724) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource:

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for CVE-2026-47724 Sigma rules on detection.fyi

Platform-specific guides for CVE-2026-47724

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)

Last updated: 2026-06-21 Research depth: standard

References (3)

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1CVE-2026-47724: Enumerate Foreign Operator Nodes via Unauthenticated Ownership Check
Expected signal: HTTP GET /api/v1/nodes/<operator_b_node_id> returning HTTP 200 with node details for a resource not owned by the authenticated operator
Test 2CVE-2026-47724: Modify Foreign Operator Network Configuration
Expected signal: HTTP PATCH /api/v1/networks/<foreign_network_id> returning HTTP 200, with data store reflecting updated network name owned by wrong operator
Test 3CVE-2026-47724: Delete Foreign Operator Tunnel — Destructive Escalation
Expected signal: HTTP DELETE /api/v1/tunnels/<foreign_tunnel_id> returning HTTP 200 or 204, followed by mesh connectivity disruption between the tunnel's associated endpoints

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for CVE-2026-47724 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Vulnerability Intelligence

CVE

Affected Software

Weakness (CWE)

Timeline

References & Proof of Concept

CVSS

What is CVE-2026-47724 nebula-mesh API Ownership Check Bypass — Cross-Operator Privilege Escalation?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for CVE-2026-47724

Testing Methodology

Unlock Pro Content

Related Detections

Tactic Hubs

Related Techniques

Same Tactic: Privilege Escalation

Popular Detections

Get new detections in your inbox