Is CVE-2026-53602 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53602 being exploited in the wild.

How severe is CVE-2026-53602?

Medium severity, with a CVSS score of 4, published 4 September 2026.

Which products and versions are affected?

github.com/forgekeep/nebula-mesh (Go) < 0.3.7, SEMVER:introduced=0,fixed=0.3.7.

Is there a fix for CVE-2026-53602?

Yes. github.com/forgekeep/nebula-mesh (Go): upgrade to 0.3.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-53602 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-53602?

Check whether you run Forgekeep Nebula-Mesh or github.com/forgekeep/nebula-mesh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53602: forgekeep nebula-mesh missing authorization in host revocation

Q: Is there a fix for CVE-2026-53602?

Yes. github.com/forgekeep/nebula-mesh (Go): upgrade to 0.3.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-53602 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-53602?

Check whether you run Forgekeep Nebula-Mesh or github.com/forgekeep/nebula-mesh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53602 · Severity: medium · CVSS 4 · Published 2026-09-04

A vulnerability in the nebula-mesh management component allows previously blocked or offboarded devices to regain access to the secure network. Because the system fails to verify a device's blocked status during certificate renewal or re-enrollment, an unauthorized device can maintain a persistent connection indefinitely. This undermines the ability of administrators to effectively revoke access for compromised or decommissioned hosts.

Technologies: Forgekeep Nebula-Mesh, github.com/forgekeep/nebula-mesh (Go). Vendors: Forgekeep, Go.

Quick answers

Is CVE-2026-53602 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53602 being exploited in the wild.
How severe is CVE-2026-53602?: Medium severity, with a CVSS score of 4, published 4 September 2026.
Which products and versions are affected?: github.com/forgekeep/nebula-mesh (Go) < 0.3.7, SEMVER:introduced=0,fixed=0.3.7.
Is there a fix for CVE-2026-53602?: Yes. github.com/forgekeep/nebula-mesh (Go): upgrade to 0.3.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53602 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-53602?: Check whether you run Forgekeep Nebula-Mesh or github.com/forgekeep/nebula-mesh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/forgekeep/nebula-mesh (Go): upgrade to 0.3.7 or later
```
go get github.com/forgekeep/nebula-mesh@v0.3.7
```

Technical details

nebula-mesh contains two authorization gaps in its certificate management logic. First, the enrollment process in `internal/api/enroll.go` fails to consult the blocklist before signing new certificates; since the blocklist is keyed by certificate fingerprint, a re-enrolled host receives a new fingerprint that bypasses existing blocks. Second, the auto-renewal path in `internal/api/updates.go` does not re-validate the status of the owning operator or Certificate Authority (CA). Consequently, hosts provisioned by a disabled operator can continue to renew their certificates indefinitely. These issues allow a host with low-privileged access (e.g., the ability to trigger re-enrollment) to maintain unauthorized network persistence. The vulnerability is addressed in version 0.3.7.

Affected products

forgekeep nebula-mesh <= 0.3.6

Identifiers

CVE-2026-53602
GHSA-339v-266x-79xr
GO-2026-5950

Timeline

2026-06-01: other: Found during internal audit
2026-06-02: disclosed
2026-07-09: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.