Executive brief
A security issue was identified in nebula-mesh, a tool used for managing secure network overlays. When generating mobile configuration bundles through the web interface, the system fails to securely erase the Certificate Authority (CA) private key from memory after use. If an attacker gains access to the server's memory—for example, through a system crash report or memory scraping—they could recover this key and use it to create unauthorized certificates, potentially gaining full access to the secure network.
Technical details
A vulnerability exists in the `mobilebundle.Build` function where the `*pki.CAManager` containing a decrypted ed25519 CA private key is not wiped upon function return. While the API handler correctly manages this lifecycle, the web handler `renderMobileBundle` does not, leaving the plaintext key on the Go heap until garbage collection occurs. This is particularly prevalent on error paths (e.g., database errors or signing failures). An attacker with the ability to read process memory, such as through core dumps, swap files, or memory-scraping techniques, can recover the CA signing key to mint arbitrary host certificates. The issue is fixed in version 0.3.8 by ensuring `Wipe()` is called on all return paths.
Affected products
- forgekeep nebula-mesh <= 0.3.7
Timeline
- 2026-06-04: disclosed
- 2026-06-04: patched: Version 0.3.8 released
- 2026-07-14: advisory
References
- https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-2p2f-px33-4vv5
- https://github.com/forgekeep/nebula-mesh/commit/1f1ab9aa8472239763d967e3d50a3cd53a1a79b9
- https://github.com/forgekeep/nebula-mesh/releases/tag/v0.3.8
- https://api.github.com/repos/forgekeep/nebula-mesh/security-advisories/GHSA-2p2f-px33-4vv5