forgekeep nebula-mesh authentication bypass via replay in signed-poll

Executive brief

A security flaw in the nebula-mesh networking tool allows attackers to reuse captured authentication requests under specific conditions. By flooding the system with requests or waiting for a service restart, an attacker could potentially intercept enrollment tokens intended for other devices. This could allow an unauthorized device to join the network if a rekeying process is already pending.

Technical details

The vulnerability is a replay attack (CWE-294) in the ADR 0004 signed-poll path. The root cause is that the signed-poll nonce cache is implemented as an in-process LRU limited to 65,536 entries, and the system allows a 5-minute clock skew. An attacker can exploit this by capturing a valid signed-poll request and replaying it after the cache is wiped (process restart) or after evicting the victim's nonce from the global LRU by flooding 65,536 nonces from a controlled host. Successful exploitation allows the attacker to fetch the agent updates body, potentially obtaining a single-use enrollment token if a rekey is pending. The issue is addressed in version 0.3.4.

Affected products

• forgekeep nebula-mesh <= 0.3.3

Timeline

• 2026-05-24: disclosed
• 2026-06-26: advisory
• 2026-06-26: patched

References

• https://api.github.com/users/ak2k
• https://github.com/ak2k
• https://api.github.com/users/ak2k/gists%7B/gist_id%7D
• https://api.github.com/users/ak2k/repos
• https://avatars.githubusercontent.com/u/19240940?v=4
• https://api.github.com/users/ak2k/events%7B/privacy%7D