Executive brief
A vulnerability in the nebula-mesh management component allows previously blocked or offboarded devices to regain access to the secure network. Because the system fails to verify a device's blocked status during certificate renewal or re-enrollment, an unauthorized device can maintain a persistent connection indefinitely. This undermines the ability of administrators to effectively revoke access for compromised or decommissioned hosts.
Technical details
nebula-mesh contains two authorization gaps in its certificate management logic. First, the enrollment process in `internal/api/enroll.go` fails to consult the blocklist before signing new certificates; since the blocklist is keyed by certificate fingerprint, a re-enrolled host receives a new fingerprint that bypasses existing blocks. Second, the auto-renewal path in `internal/api/updates.go` does not re-validate the status of the owning operator or Certificate Authority (CA). Consequently, hosts provisioned by a disabled operator can continue to renew their certificates indefinitely. These issues allow a host with low-privileged access (e.g., the ability to trigger re-enrollment) to maintain unauthorized network persistence. The vulnerability is addressed in version 0.3.7.
Affected products
- forgekeep nebula-mesh <= 0.3.6
Timeline
- 2026-06-01: other: Found during internal audit
- 2026-06-02: disclosed
- 2026-07-09: advisory