CVE-2026-53602— nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate
Quick assessment
Affected
forgekeep nebula-mesh
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
是一个自托管的 Slack Nebula mesh VPN 控制平面。在 0.3.7 版本之前，由于 在颁发证书时并未重新评估撤销/授权状态（仅在轮询时检查），导致本应不再被信任的主机仍能获取新的、有效的 Nebula 证书。具体存在两个相关的授权缺陷： 1. 封禁列表在签名/重新注册时未被强制生效 调用 时并未查询封禁列表；封禁列表仅在轮询路径中检查（ 中的 ）。由于封禁列表以证书指纹为键（ ），重新注册会生成一个新的指纹，而该新指纹并不在封禁列表中，从而绕过封禁。 2. 证书续期时未重新校验操作者/CA 状态
Possible ATT&CK Techniques 1 AI
T1550 · Use Alternate Authentication MaterialAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| forgekeep | nebula-mesh | < 0.3.7 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-53602
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate
Source: CVE Program / CVE List V5
Vulnerability Description
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula certificate, because nebula-mgmt does not re-evaluate revocation/authorization state at certificate issuance time — only at poll time. Firstly, the blocklist is not enforced at sign / re-enroll time. internal/api/enroll.go:128 calls caMgr.Sign(...) without consulting the blocklist. The blocklist is only checked in the poll path (internal/api/updates.go:57, fingerprintInBlocklist). The blocklist is keyed by certificate fingerprint (internal/store/sqlite.go), so a re-enrollment produces a new fingerprint that is not in the blocklist. Secondly, renewal does not re-validate operator / CA status. Auto-renewal at poll time (internal/api/updates.go:285-319, signHostCert) reads host.Name, host.Groups, host.NebulaIPs from the DB and re-signs without checking whether the owning operator is still active or the CA still valid. DisableOperator (internal/store/sqlite_operators.go) revokes sessions and API keys but does not retire the operator's CAs, and pki/signer.go checks only CA cert time-expiry, not operator/CA status. This issue has been patched in version 0.3.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| forgekeep | nebula-mesh | < 0.3.7 | - |
|
II. Public POCs for CVE-2026-53602
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-53602
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-53602 (1)
Vendor Pages for CVE-2026-53602 (1)
Other References for CVE-2026-53602 (1)
Same Patch Batch · forgekeep · 2026-09-04 · 7 CVEs total
| CVE-2026-61699 | 8.1 HIGH | nebula-mesh: Certificate revocation is never enforced at the mesh |
| CVE-2026-63464 | 7.7 HIGH | Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_priva |
| CVE-2026-53603 | 7.1 HIGH | nebula-mesh: Operator session tokens stored in plaintext in the database |
| CVE-2026-53604 | 7.1 HIGH | nebula-mesh: CA private key not zeroized on web mobile-bundle error paths |
| CVE-2026-55513 | 5.4 MEDIUM | nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hou |
| CVE-2026-55512 | 5.3 MEDIUM | nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entri |
IV. Related Vulnerabilities
Same product: nebula-mesh
-
CVE-2026-63464
Nebula-mesh allows non-admin operators to disable webhook SS -
CVE-2026-61699
nebula-mesh: Certificate revocation is never enforced at the -
CVE-2026-55513
nebula-mesh: Web UI host creation ignores configured enrollm -
CVE-2026-55512
nebula-mesh: Unauthenticated OIDC login endpoint allocates u -
CVE-2026-53604
nebula-mesh: CA private key not zeroized on web mobile-bundl
Same vendor: forgekeep
-
CVE-2026-63464
Nebula-mesh allows non-admin operators to disable webhook SS -
CVE-2026-61699
nebula-mesh: Certificate revocation is never enforced at the -
CVE-2026-55513
nebula-mesh: Web UI host creation ignores configured enrollm -
CVE-2026-55512
nebula-mesh: Unauthenticated OIDC login endpoint allocates u -
CVE-2026-53604
nebula-mesh: CA private key not zeroized on web mobile-bundl
Same weakness: CWE-862
-
CVE-2026-86091
ntopng before 6.7.260717 Missing Authorization on the Host P -
CVE-2026-86090
ntopng before 6.7.260717 Missing Authorization on the Notifi -
CVE-2026-82684
Tycon Systems TPDIN-Monitor-WEB3 Missing Authorization -
CVE-2026-53769
Avo: Direct attachment upload endpoint lacks upload authoriz -
CVE-2026-63464
Nebula-mesh allows non-admin operators to disable webhook SS
V. Comments for CVE-2026-53602
No comments yet