CVE-2026-61699: falha de alta gravidade em forgekeep nebula-mesh
nebula-mesh: Certificate revocation is never enforced at the mesh
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.1epss 0.4%
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromised/offboarded host from a Nebula mesh. Because the blocklist never reaches any peer's config.yml, a Blocked host retains full overlay reachability to every peer under its CA (and internal services on the mesh) for up to 30d (agent) / 365d (mobile). An attacker who exfiltrates host.key+host.crt can run stock slackhq/nebula directly, ignore the agent's 403/410 poll responses, and stay connected after the operator revokes the host. Operator-visible state (UI shows blocked, audit log records it) is misleading. This issue has been patched in version 0.7.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
forgekeep · nebula-meshCVEs relacionadas — forgekeep nebula-mesh
No mesmo produto, das mais perigosas para as menos.
CVE-2026-55512MEDIUMnebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limitingEPSS 0.6%CVE-2026-63464HIGHNebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`EPSS 0.5%CVE-2026-53603HIGHnebula-mesh: Operator session tokens stored in plaintext in the databaseEPSS 0.4%CVE-2026-55513MEDIUMnebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokensEPSS 0.3%CVE-2026-53602MEDIUMnebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificateEPSS 0.3%CVE-2026-53604HIGHnebula-mesh: CA private key not zeroized on web mobile-bundle error pathsEPSS 0.2%