nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.
Summary
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula certificate, because nebula-mgmt does not re-evaluate revocation/authorization state at certificate issuance time — only at poll time. Firstly, the blocklist is not enforced at sign / re-enroll time. internal/api/enroll.go:128 calls caMgr.Sign(...) without consulting the blocklist. The blocklist is only checked in the poll path (internal/api/updates.go:57, fingerprintInBlocklist). The blocklist is keyed by certificate fingerprint (internal/store/sqlite.go), so a re-enrollment produces a new fingerprint that is not in the blocklist. Secondly, renewal does not re-validate operator / CA status. Auto-renewal at poll time (internal/api/updates.go:285-319, signHostCert) reads host.Name, host.Groups, host.NebulaIPs from the DB and re-signs without checking whether the owning operator is still active or the CA still valid. DisableOperator (internal/store/sqlite_operators.go) revokes sessions and API keys but does not retire the operator's CAs, and pki/signer.go checks only CA cert time-expiry, not operator/CA status. This issue has been patched in version 0.3.7.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| forgekeep | nebula-mesh | before 0.3.7 | 0.3.7 | Patch available | CNA |
| — | github.com/forgekeep/nebula-mesh (Go) | before 0.3.7 | 0.3.7 | Patch available | GHSA-339v-266x-79xr |
- nebula-mesh Vendorforgekeep Affected before 0.3.7 Fixed in 0.3.7 Patch available CNA
- github.com/forgekeep/nebula-mesh (Go) Vendor— Affected before 0.3.7 Fixed in 0.3.7 Patch available GHSA-339v-266x-79xr
Remediation
- Fix · CNA nebula-mesh (forgekeep) Fixed in 0.3.7
- Fix · GHSA-339v-266x-79xr github.com/forgekeep/nebula-mesh (Go) Fixed in 0.3.7 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-53602
- 2026-10-03 Alias added: GHSA-339v-266x-79xr
References
More forgekeep vulnerabilities
- TI-2026-44169 nebula-mesh: Certificate revocation is never enforced at the mesh CVSS 3.1HIGH 8.1
- TI-2026-45231 Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private` CVSS 3.1HIGH 7.7
- TI-2026-40058 nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting CVSS 3.1MEDIUM 5.3
- TI-2026-40059 nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens CVSS 3.1MEDIUM 5.4
- TI-2026-38659 nebula-mesh: Operator session tokens stored in plaintext in the database CVSS 4.0HIGH 7.1
- TI-2026-38660 nebula-mesh: CA private key not zeroized on web mobile-bundle error paths CVSS 4.0HIGH 7.1
Sources
- CVE-2026-53602 · CVE Program
- CVE-2026-53602 · NVD
- FIRST EPSS
- GHSA-339v-266x-79xr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences