Read the docs
TI-2026-38660 Aliases CVE-2026-53604GHSA-2p2f-px33-4vv5

nebula-mesh: CA private key not zeroized on web mobile-bundle error paths

Priority LOW 30CWE-212Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, the web handler renderMobileBundle passes the real *pki.CAResolver directly into mobilebundle.Build. Inside Build, resolver.LoadByID decrypts the CA's ed25519 private key into a *pki.CAManager, but Build never calls CAManager.Wipe() on any return path. As a result, when a mobile-bundle request goes through the web UI and Build returns — especially on error (missing network, invalid prefix, DB error, signing failure) — the plaintext CA private key remains on the Go heap, unwiped, until garbage collection. An attacker able to read process memory (core dump, swap, memory-scraping) can recover the CA signing key, which would allow minting arbitrary host certificates for the mesh. The API handler already does this correctly: it loads the CAManager, defer caMgr.Wipe(), and wraps it in caManagerResolver. Only the web path is affected. This issue has been patched in version 0.3.8.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00184 8th percentileScored 2026-11-07
Fix Fixed nebula-mesh (forgekeep): 0.3.8github.com/forgekeep/nebula-mesh (Go): 0.3.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
forgekeepnebula-meshbefore 0.3.80.3.8Patch availableCNA
—github.com/forgekeep/nebula-mesh (Go)before 0.3.80.3.8Patch availableGHSA-2p2f-px33-4vv5
  • nebula-mesh Vendorforgekeep Affected before 0.3.8 Fixed in 0.3.8 Patch available CNA
  • github.com/forgekeep/nebula-mesh (Go) Vendor— Affected before 0.3.8 Fixed in 0.3.8 Patch available GHSA-2p2f-px33-4vv5

Remediation

  • Fix · CNA nebula-mesh (forgekeep) Fixed in 0.3.8
  • Fix · GHSA-2p2f-px33-4vv5 github.com/forgekeep/nebula-mesh (Go) Fixed in 0.3.8 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53604
  2. 2026-10-03 Alias added: GHSA-2p2f-px33-4vv5

References

Other 4

  • TI-2026-44169 nebula-mesh: Certificate revocation is never enforced at the mesh CVSS 3.1HIGH 8.1
  • TI-2026-45231 Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private` CVSS 3.1HIGH 7.7
  • TI-2026-40058 nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting CVSS 3.1MEDIUM 5.3
  • TI-2026-40059 nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens CVSS 3.1MEDIUM 5.4
  • TI-2026-38659 nebula-mesh: Operator session tokens stored in plaintext in the database CVSS 4.0HIGH 7.1
  • TI-2026-38658 nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences