CVE-2025-62820: slack nebula Unprotected Alternate Channel
CVSS: 4.9v3.1MediumDeferred
AliasesCGA-8989-3g7g-3ff7CGA-crvr-g978-cmrwCGA-cv8x-89j7-wv4wCGA-fx7q-g3f8-q992CGA-h65w-crwv-7jj7CGA-hp5g-2jv9-fxp8CGA-hr7f-9cgh-gm6pCGA-jjgm-cf24-rj48CGA-mjhq-25p2-w335CGA-p8jf-c7cw-h4h7CGA-pjm7-cr5q-cw58CGA-qxr8-9c5m-q6wxCGA-w352-wmgx-9jqjCGA-x3x4-g8g3-hrjfGHSA-x6fh-7qmf-69xhGO-2025-4068CGA-288g-366c-5jhxCGA-2pgr-fg2q-qrpvCGA-43hx-xhhm-8hp4CGA-5hvr-c3pw-6jw2CGA-6r75-vjcr-wpr6CGA-7fp8-r3mg-9mgrCGA-cm39-q955-jxq9CGA-gvfq-5frm-px47CGA-q674-97rr-5hvxCGA-qh84-wph2-hhhj
Published 23-10-2025Last modified 23-10-2025
Vulnerability summary
CVE-2025-62820 is a medium (CVSS 4.9) Unprotected Alternate Channel vulnerability in slack nebula. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 11.8% of scored vulnerabilities.
CVSS score
4.9/10
010
Medium · v3.1 (CVE.org)EPSS score
0.22%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 6Timeline
- 23-10-2025PublishedVulnerability first disclosed.
- 23-10-2025Last modifiedVulnerability information updated.
Description
Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.
CVSS metrics
5 scores · 5 sources · 1 versionMedium 4.9Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:LSourcesAll 5 agree
- OSV · WolfiEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L
- OSV · GoEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L
- OSV · ChainguardEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L
- NVDNIST4.9MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L
EPSS trend
Probability
0.22%
Chance of exploitation in the next 30 days
Percentile
12%
Versus all other CVEs
30-day change
+0.01 pp
From 0.21% on 21-09-2026
21-09-202621-10-2026
EPSS score0.22%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard12 products
- caddy< 2.10.2-r3
- caddy-fips< 2.10.2-r2
- caddy-man< 2.10.2-r3
- caddy-src< 2.10.2-r3
- step< 0.28.7-r4
Wolfi7 products
- caddy< 2.10.2-r3
- caddy-man< 2.10.2-r3
- caddy-src< 2.10.2-r3
- step< 0.28.7-r4
- step-ca< 0.28.4-r3
Github.com/slackhq1 product
- nebula≥ 1.9.4, < 1.9.7
Slack1 product
- nebula< 1.9.7
4 vendors · 21 products
References
7 links
- github.com/slackhq/nebulaPACKAGE