# forgekeep nebula-mesh authentication bypass via replay in signed-poll

Source: https://junglewise.ai/threats/forgekeep-nebula-mesh-authentication-bypass-via-replay-in-signed-poll-d566883f  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

Severity: low · CVSS 2.7 · Published 2026-06-26

A security flaw in the nebula-mesh networking tool allows attackers to reuse captured authentication requests under specific conditions. By flooding the system with requests or waiting for a service restart, an attacker could potentially intercept enrollment tokens intended for other devices. This could allow an unauthorized device to join the network if a rekeying process is already pending.

Technologies: [Forgekeep Nebula-Mesh](https://junglewise.ai/threats/technologies/nebula-mesh), [github.com/juev/nebula-mesh (Go)](https://junglewise.ai/threats/technologies/github-com-juev-nebula-mesh). Vendors: [Forgekeep](https://junglewise.ai/threats/vendors/forgekeep), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 2.7, published 26 June 2026.

**Which products and versions are affected?** Forgekeep Nebula-Mesh <= 0.3.3; github.com/juev/nebula-mesh (Go) <= 0.3.3.

**Is there a fix for This vulnerability?** A patch was published on 2026-06-26. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Forgekeep Nebula-Mesh or github.com/juev/nebula-mesh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a replay attack (CWE-294) in the ADR 0004 signed-poll path. The root cause is that the signed-poll nonce cache is implemented as an in-process LRU limited to 65,536 entries, and the system allows a 5-minute clock skew. An attacker can exploit this by capturing a valid signed-poll request and replaying it after the cache is wiped (process restart) or after evicting the victim's nonce from the global LRU by flooding 65,536 nonces from a controlled host. Successful exploitation allows the attacker to fetch the agent updates body, potentially obtaining a single-use enrollment token if a rekey is pending. The issue is addressed in version 0.3.4.

## Affected products

- forgekeep nebula-mesh <= 0.3.3

## Timeline

- 2026-05-24: disclosed
- 2026-06-26: advisory
- 2026-06-26: patched

## References

- [https://api.github.com/users/ak2k](https://api.github.com/users/ak2k)
- [https://github.com/ak2k](https://github.com/ak2k)
- [https://api.github.com/users/ak2k/gists%7B/gist_id%7D](https://api.github.com/users/ak2k/gists%7B/gist_id%7D)
- [https://api.github.com/users/ak2k/repos](https://api.github.com/users/ak2k/repos)
- [https://avatars.githubusercontent.com/u/19240940?v=4](https://avatars.githubusercontent.com/u/19240940?v=4)
- [https://api.github.com/users/ak2k/events%7B/privacy%7D](https://api.github.com/users/ak2k/events%7B/privacy%7D)

## Related threats

- [forgekeep nebula-mesh certificate revocation failure in agent](https://junglewise.ai/threats/cve-2026-61699-forgekeep-nebula-mesh-certificate-revocation-failure-in-agent)
- [forgekeep nebula-mesh insufficient session expiration in Web UI host creation](https://junglewise.ai/threats/cve-2026-55513-forgekeep-nebula-mesh-insufficient-session-expiration-in-web-ui)
- [forgekeep nebula-mesh resource exhaustion in OIDC login](https://junglewise.ai/threats/cve-2026-55512-forgekeep-nebula-mesh-resource-exhaustion-in-oidc-login)
- [forgekeep nebula-mesh cleartext storage of CA private key in memory](https://junglewise.ai/threats/cve-2026-53604-forgekeep-nebula-mesh-cleartext-storage-of-ca-private-key-in)
- [forgekeep nebula-mesh plaintext storage of operator session tokens](https://junglewise.ai/threats/cve-2026-53603-forgekeep-nebula-mesh-plaintext-storage-of-operator-session)