nebula-mesh: Decrypted CA private key persists in heap after signing
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.7, internal/pki/resolver.go:36-64 constructs a CAManager with the plaintext ed25519.PrivateKey after unwrapping via the master key; internal/pki/ca.go:13-16 stores it. Callers at internal/api/enroll.go:116, internal/api/updates.go:297, and internal/api/mobile_bundle.go:40 use the manager for one Sign() and drop the reference on function return — but the underlying slice contents are not wiped before release. The keystore package's contract (internal/keystore/keystore.go doc: "Callers MUST zeroise the returned plaintext DEK as soon as it is no longer needed") is not met by the CAManager consumer. Decrypted CA private keys persist in process heap until Go's GC scavenges the underlying slice — minutes to hours under load, indefinitely on idle servers. This issue has been patched in version 0.3.7.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| juev | nebula-mesh | before 0.3.7 | 0.3.7 | Patch available | CNA |
| — | github.com/juev/nebula-mesh (Go) | before 0.3.7 | 0.3.7 | Patch available | GHSA-8h84-fhqq-q58v |
| — | github.com/forgekeep/nebula-mesh (Go) | before 0.3.7 | 0.3.7 | Patch available | GHSA-8h84-fhqq-q58v |
- nebula-mesh Vendorjuev Affected before 0.3.7 Fixed in 0.3.7 Patch available CNA
- github.com/juev/nebula-mesh (Go) Vendor— Affected before 0.3.7 Fixed in 0.3.7 Patch available GHSA-8h84-fhqq-q58v
- github.com/forgekeep/nebula-mesh (Go) Vendor— Affected before 0.3.7 Fixed in 0.3.7 Patch available GHSA-8h84-fhqq-q58v
Remediation
- Fix · CNA nebula-mesh (juev) Fixed in 0.3.7
- Fix · GHSA-8h84-fhqq-q58v github.com/juev/nebula-mesh (Go) Fixed in 0.3.7 Advisory →
- Fix · GHSA-8h84-fhqq-q58v github.com/forgekeep/nebula-mesh (Go) Fixed in 0.3.7 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-48025
- 2026-10-03 Alias added: GHSA-8h84-fhqq-q58v
References
Other 5
- https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-8h84-fhqq-q58v
- https://github.com/forgekeep/nebula-mesh/commit/bca1d5914fbaf3517d3b86145a802c00de4a8122
- https://github.com/forgekeep/nebula-mesh/releases/tag/v0.3.7
- https://github.com/juev/nebula-mesh/security/advisories/GHSA-8h84-fhqq-q58v
- https://github.com/juev/nebula-mesh
More juev vulnerabilities
- TI-2026-35226 nebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpoints CVSS 4.0MEDIUM 6.9
- TI-2026-35227 nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator CVSS 4.0HIGH 7.1
- TI-2026-35499 nebula-mesh: Session and OIDC state cookies lack the Secure attribute CVSS 4.0MEDIUM 4.6
- TI-2026-35225 nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation CVSS 3.1CRITICAL 9.9
- TI-2026-36454 Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete) CVSS 3.1HIGH 8.8
- TI-2026-35223 nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml CVSS 4.0HIGH 8.7
Sources
- CVE-2026-48025 · CVE Program
- CVE-2026-48025 · NVD
- FIRST EPSS
- GHSA-8h84-fhqq-q58v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences