# CVE-2026-53602: forgekeep nebula-mesh missing authorization in host revocation

Source: https://junglewise.ai/threats/cve-2026-53602-forgekeep-nebula-mesh-missing-authorization-in-host-revocation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-53602 · Severity: medium · CVSS 4 · Published 2026-09-04

A vulnerability in the nebula-mesh management component allows previously blocked or offboarded devices to regain access to the secure network. Because the system fails to verify a device's blocked status during certificate renewal or re-enrollment, an unauthorized device can maintain a persistent connection indefinitely. This undermines the ability of administrators to effectively revoke access for compromised or decommissioned hosts.

Technologies: [Forgekeep Nebula-Mesh](https://junglewise.ai/threats/technologies/nebula-mesh), [github.com/forgekeep/nebula-mesh (Go)](https://junglewise.ai/threats/technologies/github-com-forgekeep-nebula-mesh). Vendors: [Forgekeep](https://junglewise.ai/threats/vendors/forgekeep), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-53602 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53602 being exploited in the wild.

**How severe is CVE-2026-53602?** Medium severity, with a CVSS score of 4, published 4 September 2026.

**Which products and versions are affected?** github.com/forgekeep/nebula-mesh (Go) < 0.3.7, SEMVER:introduced=0,fixed=0.3.7.

**Is there a fix for CVE-2026-53602?** Yes. github.com/forgekeep/nebula-mesh (Go): upgrade to 0.3.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53602 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-53602?** Check whether you run Forgekeep Nebula-Mesh or github.com/forgekeep/nebula-mesh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/forgekeep/nebula-mesh (Go): upgrade to 0.3.7 or later

  ```sh
  go get github.com/forgekeep/nebula-mesh@v0.3.7
  ```


## Technical details

nebula-mesh contains two authorization gaps in its certificate management logic. First, the enrollment process in `internal/api/enroll.go` fails to consult the blocklist before signing new certificates; since the blocklist is keyed by certificate fingerprint, a re-enrolled host receives a new fingerprint that bypasses existing blocks. Second, the auto-renewal path in `internal/api/updates.go` does not re-validate the status of the owning operator or Certificate Authority (CA). Consequently, hosts provisioned by a disabled operator can continue to renew their certificates indefinitely. These issues allow a host with low-privileged access (e.g., the ability to trigger re-enrollment) to maintain unauthorized network persistence. The vulnerability is addressed in version 0.3.7.

## Affected products

- forgekeep nebula-mesh <= 0.3.6

## Identifiers

- CVE-2026-53602
- GHSA-339v-266x-79xr
- GO-2026-5950

## Timeline

- 2026-06-01: other: Found during internal audit
- 2026-06-02: disclosed
- 2026-07-09: advisory

## References

- [https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-339v-266x-79xr](https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-339v-266x-79xr)
- [https://github.com/forgekeep/nebula-mesh/issues/178](https://github.com/forgekeep/nebula-mesh/issues/178)
- [https://api.github.com/repos/forgekeep/nebula-mesh/security-advisories/GHSA-339v-266x-79xr](https://api.github.com/repos/forgekeep/nebula-mesh/security-advisories/GHSA-339v-266x-79xr)

## Related threats

- [nebula-mesh missing authorization in webhook subscriptions](https://junglewise.ai/threats/cve-2026-63464-nebula-mesh-missing-authorization-in-webhook-subscriptions)
- [forgekeep nebula-mesh certificate revocation failure in agent](https://junglewise.ai/threats/cve-2026-61699-forgekeep-nebula-mesh-certificate-revocation-failure-in-agent)
- [forgekeep nebula-mesh insufficient session expiration in Web UI host creation](https://junglewise.ai/threats/cve-2026-55513-forgekeep-nebula-mesh-insufficient-session-expiration-in-web-ui)
- [forgekeep nebula-mesh resource exhaustion in OIDC login](https://junglewise.ai/threats/cve-2026-55512-forgekeep-nebula-mesh-resource-exhaustion-in-oidc-login)
- [forgekeep nebula-mesh cleartext storage of CA private key in memory](https://junglewise.ai/threats/cve-2026-53604-forgekeep-nebula-mesh-cleartext-storage-of-ca-private-key-in)